MalwareProfessional ServicesProfessional ServicesRansomwareCapture Stored DataData ExfiltratedRansom DemandedRansom PaidEmployee Data InvolvedGovernment IDIdentity (basic)EmploymentMediumContained

Faneuil, Inc.

bd_06d0fd77be8a7041 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Aug 18, 2021

Filed

Feb 1, 2022

To disclose

24 weeks

Affected

Not disclosed

Linked

3 filings

Confidence

66%

Full breach record for Faneuil, Inc. →

Fanueil, Inc. notified Delaware AG of a ransomware attack discovered on August 18, 2021. Attackers accessed and copied employee employment records (names, SSNs, addresses, emails). Fanueil paid the ransom, received confirmation of data destruction, isolated systems, and engaged forensic experts. Affected individuals were offered 24 months of Experian IdentityWorks. No evidence of data misuse was found at the time of notification.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 24 weeks / 167 days

Aug 18, 2021

Discovered

Feb 1, 2022

Filed

vs. sector median

+5 wks slower

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

California State AGbd_125d95dc09b67ece2022-02-07 · +6dVerified
Delaware State AGbd_08fd1bcfc2254b582022-02-08 · +7dCandidate

Name: Faneuil, Inc.
norm: faneuil
Domain: faneuil.com

Name: Faneuil, Inc.
norm: faneuil
Domain: faneuil.com
Industry: Professional Servicesllm

Discovered: Aug 18, 2021
Materiality determined: —
Notification sent: Feb 1, 2022
Affected individuals: Not disclosed
Data types: Government IDIdentity (basic)PII
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1119 Automated CollectionT1074 Data Staged
Threat actor: ExternalFinancial
Regulator citations: reported the incident to and cooperated with law enforcement

During the incident: Isolated all impacted systems to disrupt the attack and prevent further access by the attackers
Engaged independent cybersecurity experts to investigate the causes and impacts of the incident
Engaged a digital risk protection firm to perform internet and dark web monitoring
Paid the attackers and received confirmation that they destroyed all copied information
Reported the incident to and cooperated with law enforcement
Offered a 24-month membership in Experian IdentityWorks
Changes made: Implemented additional information security measures
Rebuilt systems to prevent any persistence of these attackers
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 24 weeks(167 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 2 states

View merged incident ↗

Delaware State AGFeb 1 · first · this page

California State AG+6d

Delaware State AG+7d

Pattern: first filing Feb 1 (DE), last Feb 8 (DE) — a 7-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://attorneygeneral.delaware.gov/wp-content/uploads/sites/50/2022/02/EXPERIAN_Job39643d01_Faneuil_L01-Gen_SAS_1.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 1, 2022
Raw hash: a943260949164d36109f7f0c39acf75dbe59b2331ac52c75176c22af160aa147

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityFaneuil, Inc.

Victim entityFaneuil, Inc.

Incidentdiscovered Aug 18, 2021

Stated responseIsolated all impacted systems to disrupt the attack and prevent further access by the attackers

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceattorneygeneral.delaware.gov