HackingTechnologyRetail & ConsumerInformationVulnerability ExploitData ExfiltratedCustomer Data InvolvedPIIIdentity (basic)PHIHealth (basic)MediumContained

TGI Direct, Inc.

bd_06df0fe277351ecf · schema v1 · pii pii-v1

Severity

Medium

Discovered

May 28, 2023

Filed

Jan 17, 2024

To disclose

33 weeks

Affected

3,428state residents only

Linked

5 filings

Confidence

71%

Full breach record for TGI Direct, Inc. →2 incidents on file

TGI Direct, Inc. disclosed a cybersecurity incident involving the MOVEit file transfer tool. On May 28, 2023, unauthorized access occurred via an exploited vulnerability. The breach exposed names, addresses, Member IDs, and medical/insurance information. TGI notified federal law enforcement, engaged third-party specialists, and applied security patches. Written notice was sent to 3,428 Washington residents on January 17, 2024, offering 12 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Leak gap clock✗ Leak >180d33 weeks discovery → filing

⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Incident timeline

discovery → filing · 33 weeks / 234 days

May 28, 2023

Begins

May 28, 2023

Discovered

Jan 17, 2024

Filed

vs. sector median

+15 wks slower

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Sitecl0pbd_5a0a30a13f79c52a2023-07-12 · +189dVerified by operator

Regulatory filings (3) · sorted by filing gap

HHS OCRbd_5aafe8f2b85da8222024-01-17Verified
Montana State AGbd_009da678313b6f362023-11-21 · +57dVerified
HHS OCRbd_7964b602f8ba8f0f2023-11-21 · +57dVerified

Name: TGI Direct, Inc.
norm: tgi direct
Domain: tgidirect.com

Name: TGI Direct, Inc.
norm: tgi direct
Domain: tgidirect.com
Industry: TechnologyllmRetail & Consumerllm

Discovered: May 28, 2023
Breach occurred: May 28, 2023
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jan 17, 2024
Affected individuals: 3,428state-resident count only
Data types: PIIIdentity (basic)PHIHealth (basic)
Data elements: NameDate of birthHealth insurance IDMedical information
WA-stated cause: Cyberattack
WA-stated duration: lifecycle 0dexposure 0d
WA-stated discovery: Found while ongoingContained same day
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Notified federal law enforcement regarding the eventProvided written notice of this incident to relevant state and federal regulators
Initial access: exploit_public_facing

During the incident: Moved quickly to investigate and respond to the incident
Assessed the security of TGI systems
Identified potentially affected individuals
Brought in third-party cybersecurity specialists
Notified federal law enforcement regarding the event
Provided access to credit monitoring services for twelve (12) months, through Experian
Provided impacted individuals with guidance on how to better protect against identity theft and fraud
Provided written notice of this incident to relevant state and federal regulators
Changes made: Applied patches designed to fix MOVEit’s vulnerabilities
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 33 weeks(234 days from discovery to filing)
Compliance flags: Leak >180dWA AG >90d
Discovery-date grounding: occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 3 states

View merged incident ↗

Montana State AGNov 21 · first

HHS OCRNov 21 · first

HHS OCR+57d

Washington State AG+57d · this page

Pattern: first filing Nov 21 (MT), last Jan 17 (WA) — a 57-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA27622.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 17, 2024
Raw hash: 3f837d0735f99b4d15da11b93e767d6c6b7e15585b88eb3da75c8f4d019a3660

Linked disclosures

Ransomware claims (1)

Regulatory filings (3) · sorted by filing gap

Reporting entityTGI Direct, Inc.

Victim entityTGI Direct, Inc.

Incidentdiscovered May 28, 2023

Stated responseMoved quickly to investigate and respond to the incident

ComplianceLeak >180d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com