Social EngineeringRetail & ConsumerRetailPhishingStolen CredentialsEmployee Data InvolvedMulti-Stage ChainIdentity (basic)Government IDEmploymentFinancial accountMediumContained

Mollie Stone's Market

bd_e70f563a8e75c8be · schema v1 · pii pii-v1

Severity

Medium

Discovered

Mar 17, 2017

Filed

Mar 27, 2017

To disclose

10 days

Affected

Not disclosed

Confidence

65%

Full breach record for Mollie Stone's Market →

Mollie Stone's Markets disclosed a phishing incident on March 17, 2017, where an employee received a fraudulent email appearing to be from a senior executive. This led to the unauthorized access of an email account containing IRS Form W-2s for 2016, exposing employees' names, addresses, Social Security numbers, and wage information. The company secured the account, notified the IRS and federal law enforcement, and is offering three years of identity theft protection to affected employees.

J jump to incidentP pin to compareR raw source

California clockDiscovered Mar 17, 2017 → Notified Mar 23, 20176d ✓ CA 60-day OK10 days discovery → filing

Incident timeline

discovery → filing · 10 days

Mar 17, 2017

Discovered

Mar 27, 2017

Filed

vs. sector median

6 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: Mollie Stone's Market
norm: mollie stone s market
Domain: molliestones.com

Name: Mollie Stone's Market
norm: mollie stone s market
Domain: molliestones.com
Industry: Retail & Consumerllm

Discovered: Mar 17, 2017
Materiality determined: —
Notification sent: Mar 23, 2017
Affected individuals: Not disclosed
Data types: Identity (basic)Government IDEmploymentFinancial account
Data elements: Social Security number
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid Accounts
Threat actor: External
Regulator citations: Notified the IRSNotified federal law enforcement authorities
Initial access: phishing_link

During the incident: Secured the email account
Enabled restrictions to prevent further unauthorized access
Notified the IRS and federal law enforcement authorities
Cooperating with their ongoing investigation
Changes made: Reinforcing our information security training program with an emphasis on the detection and avoidance of phishing email scams
Reviewing our internal procedures related to requests for sensitive information
Implementing an enhanced email system that will provide targeted threat protection and data loss prevention controls
Offering a free three-year membership of Experian’s IdentityWorks
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 10 days(10 days from discovery to filing)
Compliance flags: CA 60-day OK · 6d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Mar 17, 2017
→ Notified: Mar 23, 2017
6d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Mar 17, 2017 → Notified: Mar 23, 2017	6d	60 days (analyst band, pre-2026 discoveries)	CA 60-day OK

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-67171
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 27, 2017
Raw hash: 3dcd6b2fdf3b8eebdedfaacb2f394a87da770b55e939ed07fa3dbd21dae16b8b

Reporting entityMollie Stone's Market

Victim entityMollie Stone's Market

Incidentdiscovered Mar 17, 2017

Stated responseSecured the email account

ComplianceCA 60-day OK

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov