HackingRetail & ConsumerRetailStolen CredentialsSupply Chain (3P Vendor)Customer Data InvolvedFinancial accountPIILowContained

STC Holdings LLC

bd_ff0dcc5915600864 · schema v1 · pii pii-v1

Severity

Low

Discovered

Nov 8, 2024

Filed

Dec 9, 2024

To disclose

4 weeks

Affected

10state residents only

Linked

6 filings

Confidence

66%

Full breach record for STC Holdings LLC →

STC Holdings LLC notified the NH Attorney General of a security incident involving its ecommerce site TobaccoPipes.com. A third-party app (FreshClick via BigCommerce) was compromised, allowing a malicious actor to skim credit card data from shoppers between Oct 15 and Nov 7, 2024. STC was notified on Nov 8, 2024. 10 NH residents were affected. STC removed the app, secured systems, and engaged forensic investigators.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 24 days

discovery → filing · 4 weeks / 31 days

Oct 15, 2024

Begins

Nov 8, 2024

Discovered

Dec 9, 2024

Filed

vs. sector median

3 wks faster

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Vermont State AGbd_5f342a4f10d596f12024-12-02 · +7dVerified
Massachusetts State AGbd_11707656521ddf0f2024-11-28 · +11dVerified
Maine State AGbd_f0cbd526669bc7082024-11-28 · +11dVerified
Montana State AGbd_e11fc2bc71477d0e2024-11-27 · +12dCandidate

Show 1 more filing ↓up to 12d gap

Indiana State AGbd_f6e6a68a365e70d42024-11-27 · +12dVerified

Name: STC Holdings LLC
norm: stc holdings
Domain: tobaccopipes.com

Name: STC Holdings LLC
norm: stc holdings
Domain: tobaccopipes.com
Industry: Retail & Consumerllm

Discovered: Nov 8, 2024
Breach occurred: Oct 15, 2024 – Nov 7, 2024
Undetected for: 24 daysoccurrence → discovery
Materiality determined: —
Notification sent: Nov 8, 2024
Affected individuals: 10state-resident count only
Data types: Financial accountPII
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1530 Data from Cloud Storage ObjectT1071 Application Layer Protocol
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Office of the Attorney General Consumer Protection Bureau
Third party: via BigCommerce / FreshClick
Initial access: supply_chain

During the incident: BigCommerce uninstalled the FreshClick app from STC’s ecommerce website immediately upon learning of the Incident
BigCommerce removed compromised API’s and malicious code, if any, from STC’s website
STC’s IT team secured its systems to prevent any unauthorized access
STC’s IT team is engaging with outside experts to conduct a n independent forensics investigation into the matter
STC has notified all potentially affected customers in the Commonwealth
Changes made: Engaging security experts to conduct an independent forensics investigation to determine any necessary remedial measures
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 4 weeks(31 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

Montana State AGNov 27 · first

Indiana State AGNov 27 · first

Massachusetts State AG+1d

Maine State AG+1d

Vermont State AG+5d

New Hampshire State AG+12d · this page

Pattern: first filing Nov 27 (MT), last Dec 9 (NH) — a 12-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/stc-holdings-tobaccopipes-20241209.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 9, 2024
Raw hash: 943b085736fa316a934fa25facdf10f3eced4e2a3631c92f94fb18ae23eca278

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entitySTC Holdings LLC

Victim entitySTC Holdings LLC

Incidentdiscovered Nov 8, 2024

Stated responseBigCommerce uninstalled the FreshClick app from STC’s ecommerce website immediately upon learning of the Incident

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov