Chief River Nursery disclosed a website security incident involving its checkout page. Payment card data entered between February 12, 2026, and March 17, 2026, may have been copied without authorization.
Chief River Nursery’s Data Breach Investigation
Chief River Nursery (“CRN”) recently disclosed a data security incident involving suspicious activity on its website. According to the company’s notice, CRN became aware of suspicious activity on or around March 17, 2026, and promptly launched an investigation into the nature and scope of the incident.
On May 1, 2026, the investigation determined that payment card data entered on CRN’s checkout page may have been copied without authorization between February 12, 2026, and March 17, 2026. The incident was described as an external system breach, or hacking.
The information that may have been copied includes names and payment card information. This type of breach can be especially concerning because payment card data may be used for unauthorized transactions or fraud. Even if a card has not yet been misused, affected individuals should remain alert and take steps to protect their financial accounts.
CRN stated that it moved quickly to investigate and respond to the incident, assess the security of its website, and identify potentially affected individuals. The company also said it is reviewing its existing policies and procedures as part of its ongoing commitment to information security.
On or about June 1, 2026, CRN provided written notice to 72 Maine residents. CRN also reported that it is notifying relevant state regulators and the three major credit reporting agencies, Equifax, Experian, and TransUnion, as necessary.
Although the total number of affected individuals has not been provided, anyone who made a purchase through Chief River Nursery’s checkout page during the affected period should carefully review payment card statements and monitor for suspicious activity.
When Did This Breach Occur?
The breach reportedly occurred between February 12, 2026, and March 17, 2026.
CRN became aware of suspicious website activity on or around March 17, 2026. The breach was discovered through the investigation on May 1, 2026.
Written notices were sent to affected Maine residents on or about June 1, 2026.
What Information Was Breached?
The information that may have been copied without authorization includes:
- Name
- Payment card information
Affected individuals should review their notice and contact their payment card issuer if they detect suspicious activity.
What You Can Do
If you received a notice from Chief River Nursery, consider taking these steps:
- Review payment card and bank statements for unauthorized charges.
- Report suspicious activity to the issuing bank using the number on the back of your card.
- Request a replacement card if you believe your payment card was compromised.
- Monitor free credit reports for errors or suspicious activity.
- Consider placing a fraud alert or security freeze on your credit file.
- Keep records of any fraudulent charges, replacement card issues, or time spent responding to the breach.
You may also want to learn whether you have legal options after your payment card information was potentially exposed.
File a Data Breach Lawsuit Against Chief River Nursery
If you received a data breach notification from Chief River Nursery, you may have legal rights. Businesses that collect payment card information are expected to use reasonable safeguards to protect that data from unauthorized access.
A data breach lawsuit may seek compensation for loss of privacy, time spent addressing the breach, out-of-pocket expenses, fraudulent charges, card replacement issues, and other related harms.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
