HackingRetail & ConsumerRetailStolen CredentialsSupply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedIdentity (basic)Financial accountMediumContained

STC Holdings LLC

bd_f0cbd526669bc708 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Nov 8, 2024

Filed

Nov 28, 2024

To disclose

20 days

Affected · nationwide

2,1515 in this filing

Linked

6 filings

Confidence

65%

Full breach record for STC Holdings LLC →

STC Holdings LLC (tobaccopipes.com) reported a data breach affecting 2,151 individuals, including 5 Maine residents. Unauthorized access occurred between Oct 15 and Nov 7, 2024, via a compromised third-party app (FreshClick) on BigCommerce. Compromised data included names, addresses, and credit card info. Discovered Nov 8, 2024. Notifications sent Nov 27, 2024.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Nov 8, 2024 → Filed with AG Nov 28, 202420d ✓ ME AG ≤30d20 days discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 24 days

discovery → filing · 20 days

Oct 15, 2024

Begins

Nov 8, 2024

Discovered

Nov 28, 2024

Filed

vs. sector median

7 wks faster

This filing is one of 6 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Massachusetts State AGbd_11707656521ddf0f2024-11-28Verified
Montana State AGbd_e11fc2bc71477d0e2024-11-27 · +1dCandidate
Indiana State AGbd_f6e6a68a365e70d42024-11-27 · +1dVerified
Vermont State AGbd_5f342a4f10d596f12024-12-02 · +4dVerified

Show 1 more filing ↓up to 11d gap

New Hampshire State AGbd_ff0dcc59156008642024-12-09 · +11dVerified

Name: STC Holdings LLC
norm: stc holdings

Name: STC Holdings LLC
norm: stc holdings
Domain: tobaccopipes.com
Industry: Retail & Consumerllm

Discovered: Nov 8, 2024
Breach occurred: Oct 15, 2024 – Nov 7, 2024
Undetected for: 24 daysoccurrence → discovery
Materiality determined: —
Notification sent: Nov 27, 2024
Affected individuals: 2,151state + nationwide
Data types: Identity (basic)Financial account
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1530 Data from Cloud Storage ObjectT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Notified Maine Attorney General
Third party: via BigCommerce / FreshClick
Initial access: supply_chain

During the incident: Immediately uninstalled the compromised third-party application from our ecommerce website
Secured our systems to prevent further unauthorized access
Engaging security experts to conduct an independent forensics investigation
Notifying relevant government agencies in accordance with applicable data privacy laws
Notifying individuals, like yourself, whose information may have been compromised
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 20 days(20 days from discovery to filing)
Compliance flags: ME AG ≤30d · 20d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Nov 8, 2024
→ Filed with AG: Nov 28, 2024
20d 30 days ME AG ≤30d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Nov 8, 2024 → Filed with AG: Nov 28, 2024	20d	30 days	ME AG ≤30d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

Montana State AGNov 27 · first

Indiana State AGNov 27 · first

Massachusetts State AG+1d

Maine State AG+1d · this page

Vermont State AG+5d

New Hampshire State AG+12d

Pattern: first filing Nov 27 (MT), last Dec 9 (NH) — a 12-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/4caf382d-38ea-45fb-995a-8b72869de822.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 28, 2024
Raw hash: 6284230d0cf1b4c0ab53cdab565da7ee50dcb80fe7e5ddb4091712738a49047b

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entitySTC Holdings LLC

Victim entitySTC Holdings LLC

Incidentdiscovered Nov 8, 2024

Stated responseImmediately uninstalled the compromised third-party application from our ecommerce website

ComplianceME AG ≤30d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov