MalwareTechnologyInformationRansomwareData ExfiltratedRansom DemandedRansom PaidEmployee Data InvolvedGovernment IDIdentity (basic)EmploymentMediumContained

Faneuil, Inc.

bd_08fd1bcfc2254b58 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Aug 18, 2021

Filed

Feb 8, 2022

To disclose

25 weeks

Affected

Not disclosed

Linked

3 filings

Confidence

66%

Full breach record for Faneuil, Inc. →

Faneuil, Inc. notified Delaware AG of a ransomware attack discovered on August 18, 2021. Attackers accessed and copied employee records (names, SSNs, addresses, emails) before encrypting systems. Faneuil paid the ransom, confirmed data destruction, isolated systems, engaged forensic experts, and reported to law enforcement. Affected individuals received 24 months of Experian IdentityWorks. No public data release was observed.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 25 weeks / 174 days

Aug 18, 2021

Discovered

Feb 8, 2022

Filed

vs. sector median

+6 wks slower

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

California State AGbd_125d95dc09b67ece2022-02-07 · +1dVerified
Delaware State AGbd_06d0fd77be8a70412022-02-01 · +7dCandidate

Name: Faneuil, Inc.
norm: faneuil
Domain: faneuil.com

Name: Faneuil, Inc.
norm: faneuil
Domain: faneuil.com
Industry: Technologyllm

Discovered: Aug 18, 2021
Materiality determined: —
Notification sent: Feb 1, 2022
Affected individuals: Not disclosed
Data types: Identity (basic)Government ID
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: reported the incident to and cooperated with law enforcement

During the incident: Isolated all impacted systems to disrupt the attack and prevent further access by the attackers
Engaged independent cybersecurity experts to investigate the causes and impacts of the incident
Rebuilt systems and recover from the attack
Engaged with the ransomware group and ultimately paid them
Received confirmation from the attackers that they destroyed all copied information
Engaged a digital risk protection firm to perform internet and dark web monitoring for indications of Faneuil data
Reported the incident to and cooperated with law enforcement
Changes made: Implemented additional information security measures
Rebuilt systems, to prevent any persistence of these attackers, to prevent similar future incidents and to enhance the protection of information that we hold
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 25 weeks(174 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 2 states

View merged incident ↗

Delaware State AGFeb 1 · first

California State AG+6d

Delaware State AG+7d · this page

Pattern: first filing Feb 1 (DE), last Feb 8 (DE) — a 7-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://attorneygeneral.delaware.gov/wp-content/uploads/sites/50/2022/02/EXPERIAN_Job39643d01_Faneuil_L01-Gen_SAS_1.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 8, 2022
Raw hash: 2423a9ea1d49e8c4872abe9deb16e6b1df92710ba4ecf07a3913fa2655a5f40c

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityFaneuil, Inc.

Victim entityFaneuil, Inc.

Incidentdiscovered Aug 18, 2021

Stated responseIsolated all impacted systems to disrupt the attack and prevent further access by the attackers

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceattorneygeneral.delaware.gov