HackingRetail & ConsumerRetailStolen CredentialsTargetedCustomer Data InvolvedAuthenticationCredentialsIdentity (basic)MediumContained

HOT TOPIC

bd_f862836a1959a255 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Nov 18, 2023

Filed

Mar 28, 2024

To disclose

19 weeks

Affected

3,655state residents only

Linked

4 filings

Confidence

69%

All records for HOT TOPIC →4 incidents on file

Account takeover notice

HOT TOPIC notified customers of unauthorized attempts to access their accounts. The filing says: “Hot Topic was not the source of the account credentials used in these attacks.”

Hot Topic, Inc. notified Washington AG of unauthorized access to Hot Topic Rewards accounts via credential stuffing using valid credentials from a third-party source. Incident occurred Nov 18-25, 2023. 3,655 Washington residents affected. Data potentially exposed: names, emails, order history, phone numbers, birth dates, addresses. No payment card full numbers exposed. Bot protection and password resets implemented.

J jump to incidentP pin to compareR raw source

Washington clock✗ WA AG >90d19 weeks discovery → filing

⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Incident timeline

discovery → filing · 19 weeks / 131 days

Nov 18, 2023

Begins

Nov 18, 2023

Discovered

Mar 28, 2024

Filed

vs. sector median

+9 wks slower

This filing is one of 4 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

California State AGbd_f2c74f7617c5eb212024-03-28Verified
Oregon State AGbd_33fdb7c98192ec732024-03-29 · +1dCandidate
Illinois State AGbd_d7d4d27d0a0a53542024-03-01 · +27dVerified

Name: HOT TOPIC
norm: hot topic

Name: HOT TOPIC
norm: hot topic
Industry: Retail & Consumerllm

Discovered: Nov 18, 2023
Access attempts: Nov 18, 2023 – Nov 25, 2023
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Mar 17, 2024
Affected individuals: 3,655state-resident count only
Data types: Identity (basic)Credentials
Data elements: NameUsername + password
WA-stated cause: Unauthorized Access
WA-stated duration: lifecycle 1-99dexposure 1-99d
WA-stated discovery: Found while ongoing
Attack vector: Phishing
MITRE ATT&CK: T1078 Valid AccountsT1566.002 Spearphishing Link
Threat actor: ExternalFinancial
Initial access: valid_credentials

During the incident: Working with outside cybersecurity experts
Implemented specific steps to safeguard our website and mobile application from automated “credential stuffing” attacks, including deploying bot protection software
Updating your online account to require you to set a new password
Changes made: Deploying bot protection software designed to stop such attacks
Updating your online account to require you to set a new password
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 19 weeks(131 days from discovery to filing)
Compliance flags: WA AG >90d
Discovery-date grounding: occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Illinois State AGMar 1 · first

California State AG+27d

Washington State AG+27d · this page

Oregon State AG+28d

Pattern: first filing Mar 1 (IL), last Mar 29 (OR) — a 28-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA28434.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 28, 2024
Raw hash: d53816b9ad6f8d905e134b9393022e3b4790eecb8b37f9cc14249a13d7cafd1e

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityHOT TOPIC

Victim entityHOT TOPIC

Incidentdiscovered Nov 18, 2023

Stated responseWorking with outside cybersecurity experts

ComplianceWA AG >90d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com