The Pennsylvania Attorney General's Office disclosed a data breach affecting Essential Wholesale & Labs on February 16, 2023. The incident stemmed from unauthorized code injected into the company’s website, leading to the potential exposure of sensitive customer data. Compromised information includes names, shipping addresses, payment card details, and email addresses for transactions conducted during two distinct periods: April 27 – May 22, 2022, and October 11 – November 5, 2022. While the total number of impacted individuals remains undisclosed, the breach confirmed exposure for at least five Rhode Island residents.The breach resulted from a website compromise, likely due to a vulnerability exploited to inject malicious code. The exposed data—particularly payment card information—poses significant risks, including financial fraud and identity theft. Although the company has not detailed the attack vector (e.g., third-party plugin, unpatched software), the incident underscores critical gaps in web security controls. No evidence suggests ransomware or a broader systemic attack, but the exposure of financial and personal identifiers elevates the severity due to the potential for downstream fraud and reputational harm. The company has not publicly confirmed whether the vulnerability has been remediated or if affected customers were notified beyond regulatory disclosures.

The Vermont Office of the Attorney General reported a data breach involving Essential Wholesale & Labs on February 22, 2023. The breach occurred on May 22, 2022, due to unauthorized code on the company’s website, potentially exposing customer names, shipping addresses, payment card information, and email addresses. Approximately UNKN individuals may have been affected, with 5 residents specifically noted from Rhode Island.