HackingRetail & ConsumerRetailVulnerability ExploitCustomer Data InvolvedDelayed DiscoveryIdentity (basic)Financial accountFinancial credentialsLowContained

WILTON BRANDS LLC

bd_eef2e597d73594d0 · schema v1 · pii pii-v1

Severity

Low

Discovered

Oct 31, 2012

Filed

Dec 12, 2012

To disclose

6 weeks

Affected

Not disclosed

Linked

5 filings

Confidence

64%

Full breach record for WILTON BRANDS LLC →

Wilton Brands LLC disclosed that a malicious user added a file to a server hosting www.wilton.com and www.copco.com, allowing access to user information including names, addresses, and payment card details (card numbers, expiration dates, security codes) between July 19, 2012, and October 2, 2012. The incident was discovered on October 31, 2012, by a service provider. Wilton contained the incident, engaged forensic investigators, notified law enforcement and its merchant bank, and changed its payment processing system to stop storing sensitive card data. Affected individuals were offered one year of Experian ProtectMyID.

J jump to incidentP pin to compareR raw source

California clockDiscovered Oct 31, 2012 → Notified Dec 10, 201240d ✓ CA 60-day OK6 weeks discovery → filing

Incident timeline

undetected · 104 days

discovery → filing · 6 weeks / 42 days

Jul 19, 2012

Begins

Oct 31, 2012

Discovered

Dec 12, 2012

Filed

vs. sector median

2 wks faster

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

New Hampshire State AGbd_1b6de679c9d6de972012-12-12Candidate
Massachusetts State AGbd_4bb62f4ff8f0b1772012-12-17 · +5dVerified
California State AGbd_399085c1fc2a54d92013-01-24 · +43dVerified
Massachusetts State AGbd_23d742fcde232b322013-01-28 · +47dCandidate

Name: WILTON BRANDS LLC
norm: wilton brands
Domain: wilton.com

Name: WILTON BRANDS LLC
norm: wilton brands
Domain: wilton.com
Industry: Retail & Consumerllm

Discovered: Oct 31, 2012
Breach occurred: Jul 19, 2012 – Oct 2, 2012
Undetected for: 104 daysoccurrence → discovery
Materiality determined: —
Notification sent: Dec 10, 2012
Affected individuals: Not disclosed
Data types: Identity (basic)Financial accountFinancial credentials
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1078 Valid Accounts
Threat actor: External
Regulator citations: Notified its merchant bankNotified law enforcement
Third party: via service provider
Initial access: exploit_public_facing

During the incident: Took steps to address and contain the incident the same day it was discovered
Engaged a computer forensic investigator to perform an investigation
Self-reported the incident by notifying its merchant bank
Notified law enforcement of this incident
Changes made: Changed its payment processing system and is no longer storing full card numbers, expiration dates or security codes on the computer server
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 weeks(42 days from discovery to filing)
Compliance flags: CA 60-day OK · 40d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Oct 31, 2012
→ Notified: Dec 10, 2012
40d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Oct 31, 2012 → Notified: Dec 10, 2012	40d	60 days (analyst band, pre-2026 discoveries)	CA 60-day OK

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 3 states

View merged incident ↗

New Hampshire State AGDec 12 · first

California State AGDec 12 · first · this page

Massachusetts State AG+5d

California State AG+43d

Massachusetts State AG+47d

Pattern: first filing Dec 12 (NH), last Jan 28 (MA) — a 47-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-37224
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 12, 2012
Raw hash: 09472c54c74146678e415c896069d71279ec6577e4fcfdbfb2c843d9a5ea1233

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityWILTON BRANDS LLC

Victim entityWILTON BRANDS LLC

Incidentdiscovered Oct 31, 2012

Stated responseTook steps to address and contain the incident the same day it was discovered

ComplianceCA 60-day OK

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov