PhysicalRetail & ConsumerTheftCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDFinancial accountMediumContained

UNITED NATURAL FOODS, INC.

bd_f72c8707a226fe27 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Oct 1, 2013

Filed

Jan 8, 2014

To disclose

14 weeks

Affected

1state residents only

Confidence

66%

Full breach record for UNITED NATURAL FOODS, INC. →3 incidents on file

United Natural Foods, Inc. (UNFI) reported the theft of laptops and hard drives from an Auburn, California warehouse between Sept 3 and Oct 3, 2013. The breach compromised PII including SSNs and financial account numbers of at least one New Hampshire resident. UNFI secured the site, cooperated with police, and provided 12 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 28 days

discovery → filing · 14 weeks / 99 days

Sep 3, 2013

Begins

Oct 1, 2013

Discovered

Jan 8, 2014

Filed

vs. sector median

+6 wks slower

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed1 affectedView incident

Name: MCGUIREWOODS LLP
norm: mcguirewoods

Name: UNITED NATURAL FOODS, INC.
norm: united natural foods
Domain: unfi.com
Industry: Retail & Consumerllm

Discovered: Oct 1, 2013
Breach occurred: Sep 3, 2013 – Oct 3, 2013
Undetected for: 28 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jan 8, 2014
Affected individuals: 1state-resident count only
Data types: Identity (basic)Government IDFinancial account
Attack vector: Unknown
MITRE ATT&CK: T1052 Exfiltration Over Physical Medium
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Attorney General

During the incident: Took immediate action to secure the warehouse
Working in cooperation with the Auburn police department and outside counsel to determine the scope of the information accessed
Cooperating with the local district attorney to prosecute the individuals in whose possession the stolen laptops were found
Arranged to have AllClear ID credit monitoring for 12 months at no cost to the individual
Implementing new physical security measures at the warehouse
Undertaken a complete review of all paper records to ensure timely destruction of the paper records in the warehouse in accordance with the company’s retention policy
Removed all retired hard drives and laptops from the warehouse and has placed them in a more secure location
Changes made: Implementing new physical security measures at the warehouse
Undertaken a complete review of all paper records to ensure timely destruction of the paper records in the warehouse in accordance with the company’s retention policy
Removed all retired hard drives and laptops from the warehouse and has placed them in a more secure location
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 14 weeks(99 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/united-natural-foods-20140108.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 8, 2014
Raw hash: 53518e1bd86bd40bb3918d5b887d1474debda33a7259c789707bea16f80ce05b

Reporting entityMCGUIREWOODS LLP

Victim entityUNITED NATURAL FOODS, INC.

Incidentdiscovered Oct 1, 2013

Stated responseTook immediate action to secure the warehouse

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov