John and Kira's Chocolates

John and Kira’s Chocolates reported a data breach affecting its third-party e-commerce platform, CommerceV3. Unauthorized access occurred between November 24, 2021, and July 1, 2022, via a skimmer attack. The breach potentially exposed payment card information and personal data of 9,328 customers, including 72 in New Hampshire. CommerceV3 conducted a forensic investigation and implemented security upgrades, including tokenization.

Affected (this filing): 9,328

John & Kira's Chocolates notified customers that their third-party e-commerce provider, CommerceV3, suffered an unauthorized access incident. An unauthorized party accessed CommerceV3 systems between November 24, 2021, and July 1, 2022, potentially obtaining customer order information including names, email addresses, billing addresses, payment card numbers, CVV codes, and expiration dates. John & Kira's was notified on June 12, 2023, and sent notices on June 15, 2023. The threat has been eliminated.