HackingRetail & ConsumerRetailSQL InjectionTargetedData ExfiltratedIdentity (basic)Financial accountLowContained

Chefs' Toys, LLC

bd_e3f9328ea5c46db9 · schema v1 · pii pii-v1

Severity

Low

Discovered

Mar 29, 2022

Filed

Jul 5, 2022

To disclose

14 weeks

Affected

9state residents only

Linked

5 filings

Confidence

62%

Full breach record for Chefs' Toys, LLC →

Chefs' Toys, LLC notified customers of a payment card skimming incident. Hidden malicious code captured names and card numbers from Nov 12, 2021 to Apr 26, 2022. Discovered Mar 29, 2022 via forensic analysis. Remediation included password updates and security controls. No specific count of affected individuals provided.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 137 days

discovery → filing · 14 weeks / 98 days

Nov 12, 2021

Begins

Mar 29, 2022

Discovered

Jul 5, 2022

Filed

vs. sector median

+6 wks slower

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Maine State AGbd_418e1bb4d6a76c472022-07-05Candidate
Massachusetts State AGbd_75e3dba5a020a67e2022-07-08 · +3dVerified
California State AGbd_bb3b34fb201a45e92022-07-08 · +3dVerified
Indiana State AGbd_64708e127592f1e82022-06-30 · +5dVerified

Name: Chefs' Toys, LLC
norm: chefs toys
Domain: chefstoys.com

Name: Chefs' Toys, LLC
norm: chefs toys
Domain: chefstoys.com
Industry: Retail & Consumerllm

Discovered: Mar 29, 2022
Breach occurred: Nov 12, 2021 – Apr 26, 2022
Undetected for: 137 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jun 24, 2022
Affected individuals: 9state-resident count only
Data types: Identity (basic)Financial account
Attack vector: Misconfiguration
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1056 Input Capture
Threat actor: ExternalFinancial
Initial access: exploit_public_facing

During the incident: Began an investigation and review of our website
Obtained forensic analysis from an outside cyber security company
Updating user passwords
Implementing additional security safeguards and controls on our website
Changes made: Updating user passwords
Implementing additional security safeguards and controls on our website
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 14 weeks(98 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Indiana State AGJun 30 · first

Maine State AG+5d

Montana State AG+5d · this page

Massachusetts State AG+8d

California State AG+8d

Pattern: first filing Jun 30 (IN), last Jul 8 (CA) — a 8-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-Notification-Letter-373.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 5, 2022
Raw hash: e613034f0dfe1dd209f6f16ca7f128878c9ef561a22d757b94c650834947a07a

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityChefs' Toys, LLC

Victim entityChefs' Toys, LLC

Incidentdiscovered Mar 29, 2022

Stated responseBegan an investigation and review of our website

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov