HackingManufacturingManufacturingEmployee Data InvolvedIdentity (basic)Government IDHealth (basic)Financial accountEmploymentMediumContained

MULTI-COLOR CORPORATION

bd_03b2125705f30ee4 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Sep 29, 2022

Filed

Oct 29, 2022

To disclose

4 weeks

Affected

Not disclosed

Linked

4 filings

Confidence

64%

Full breach record for MULTI-COLOR CORPORATION →2 incidents on file

Multi-Color Corporation (MCC) experienced a cyberattack on September 29, 2022, where a third party gained unauthorized access to its IT environment. The incident compromised employee personnel files, including names, SSNs, driver's license numbers, health insurance data, and financial information. MCC contained the threat within hours, retained external incident response teams, notified the FBI and various regulators, and offered 24 months of credit monitoring to affected employees and their families.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 14 days

discovery → filing · 4 weeks / 30 days

Sep 15, 2022

Begins

Sep 29, 2022

Discovered

Oct 29, 2022

Filed

vs. sector median

6 wks faster

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Massachusetts State AGbd_7152e5ec374c3a722022-10-29Verified
New Hampshire State AGbd_ce060c18142b36992022-10-28 · +1dCandidate
Indiana State AGbd_6a669c7f60ac4c922022-10-26 · +3dVerified

Name: MULTI-COLOR CORPORATION
norm: multi color
Domain: mcclabel.com

Name: MULTI-COLOR CORPORATION
norm: multi color
Domain: mcclabel.com
Industry: Manufacturingllm

Discovered: Sep 29, 2022
Breach occurred: Sep 15, 2022
Undetected for: 14 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: Identity (basic)Government IDHealth (basic)Financial accountEmployment
Data elements: Social Security numberDate of birth
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: Notified the Federal Bureau of InvestigationFiled incident reports with certain state regulatory authoritiesNotified applicable foreign data protection regulators in the European Union, the United Kingdom, and in Australia

During the incident: Deployed security measures to contain and mitigate the threat
Retained an external incident response team to accelerate recovery efforts
Retained independent third-party IT security consultants to analyze the incident
Proactively notified the Federal Bureau of Investigation
Filed incident reports with certain state regulatory authorities
Notified applicable foreign data protection regulators in the European Union, the United Kingdom, and in Australia
Provided complimentary credit monitoring and identity theft protection services for 24 months through Equifax
Changes made: Analyzed information security programs and tools and the status of data security hygiene
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 4 weeks(30 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Indiana State AGOct 26 · first

New Hampshire State AG+2d

Massachusetts State AG+3d

California State AG+3d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-558726
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 29, 2022
Raw hash: e8b539c8c93ed5d4ebfd39b13cb911e6343b5f4d4d268fc48276dc77c76a5327

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityMULTI-COLOR CORPORATION

Victim entityMULTI-COLOR CORPORATION

Incidentdiscovered Sep 29, 2022

Stated responseDeployed security measures to contain and mitigate the threat

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov