HackingRetail & ConsumerRetailVulnerability ExploitData ExfiltratedCustomer Data InvolvedIdentity (basic)Financial accountFinancial credentialsLowContained

Boersma Bros. LLC

bd_fde2464efb512a51 · schema v1 · pii pii-v1

Severity

Low

Discovered

Dec 6, 2014

Filed

Dec 23, 2014

To disclose

17 days

Affected

Not disclosed

Confidence

64%

Boersma Bros. LLC (dba DutchWear) notified customers of a security breach affecting its e-commerce site between November 7 and December 6, 2014. Unauthorized access exposed payment information including names, addresses, phone numbers, credit card numbers, expiration dates, and security codes. The company took the site offline and is building a new site with enhanced security.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 29 days

discovery → filing · 17 days

Nov 7, 2014

Begins

Dec 6, 2014

Discovered

Dec 23, 2014

Filed

vs. sector median

5 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: Boersma Bros. LLC
norm: boersma bros
Domain: shop.dutchbros.com

Name: Boersma Bros. LLC
norm: boersma bros
Domain: shop.dutchbros.com
Industry: Retail & Consumerllm

Discovered: Dec 6, 2014
Breach occurred: Nov 7, 2014 – Dec 6, 2014
Undetected for: 29 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: Identity (basic)Financial accountFinancial credentials
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 Channel
Threat actor: External
Regulator citations: Working with the proper authorities
Initial access: exploit_public_facing

During the incident: Immediately took down our e-commerce site shop.dutchbros.com
Conducted an extensive investigation of our computer systems
Working with the proper authorities to ensure the incident is properly addressed
Set up a toll-free help line so you may contact us directly with any questions about this incident
Changes made: The former website will remain offline permanently
Building a brand new site, with new security features and protocols intended to prevent this type of breach from happening again
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 17 days(17 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-47840
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 23, 2014
Raw hash: 8073c67ef61a7c970b93f756d5f8fbac842b752f4956dc9398e3110ba5993a14

Reporting entityBoersma Bros. LLC

Victim entityBoersma Bros. LLC

Incidentdiscovered Dec 6, 2014

Stated responseImmediately took down our e-commerce site shop.dutchbros.com

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov