HackingStolen CredentialsSupply Chain (3P Vendor)Customer Data InvolvedFINANCIAL_ACCOUNTPIILowContained
STC Holdings LLC
bd_ff0dcc5915600864 · schema v1 · pii pii-v1
Full breach record for STC Holdings LLC →STC Holdings LLC notified the NH Attorney General of a security incident involving its ecommerce site TobaccoPipes.com. A third-party app (FreshClick via BigCommerce) was compromised, allowing a malicious actor to skim credit card data from shoppers between Oct 15 and Nov 7, 2024. STC was notified on Nov 8, 2024. 10 NH residents were affected. STC removed the app, secured systems, and engaged forensic investigators.
This filing is one of 5 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (4) · sorted by filing gap
- bd_5f342a4f10d596f1Vermont State AGfiled 2024-12-02(7d gap)Verified
- bd_f0cbd526669bc708Maine State AGfiled 2024-11-28(11d gap)Verified
- bd_e11fc2bc71477d0eMontana State AGfiled 2024-11-27(12d gap)Candidate
- bd_f6e6a68a365e70d4Indiana State AGfiled 2024-11-27(12d gap)Verified
Source provenance
- Source URL
- https://mm.nh.gov/files/uploads/doj/remote-docs/stc-holdings-tobaccopipes-20241209.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Dec 9, 2024
- Raw hash
- 943b085736fa316a934fa25facdf10f3eced4e2a3631c92f94fb18ae23eca278
Reporting entity
- Name
- STC Holdings LLCnorm: stc holdings
- Domain
- tobaccopipes.com
Victim entity
- Name
- STC Holdings LLCnorm: stc holdings
- Domain
- tobaccopipes.com
Incident
- Discovered
- Nov 8, 2024
- Materiality determined
- —
- Notification sent
- Nov 8, 2024
- Affected individuals
- 10
- Data types
- FINANCIAL_ACCOUNTPII
- Attack vector
- Third-Party / Supply Chain
- MITRE ATT&CK
- T1530 Data from Cloud Storage ObjectT1071 Application Layer Protocol
- Threat actor
- ExternalFinancial
- Regulator citations
- Notified New Hampshire Office of the Attorney General Consumer Protection Bureau
- Third party
- via BigCommerce / FreshClick
- Initial access
- supply_chain
Compliance
- Time to disclose
- 4 weeks(31 days from discovery to filing)
- Compliance flags
- — (clock not assessable for this source)
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.