The California Office of the Attorney General disclosed in September 2014 that Goodwill Industries International (GII) suffered a data breach due to malware attacks on a third-party vendor’s systems. The incident, which spanned from February 10, 2013, to August 14, 2014, exposed payment card information of customers across twenty Goodwill member stores. Investigations confirmed that the malware was not present on Goodwill’s internal systems, limiting the breach’s origin to the vendor’s compromised infrastructure. While the exact number of affected individuals was not specified, the prolonged exposure period heightened risks of fraudulent transactions and unauthorized card usage. The breach underscored vulnerabilities in third-party security protocols, raising concerns over customer trust and financial liability for GII, though no evidence suggested broader data exfiltration beyond payment details.