HackingManufacturingManufacturingData ExfiltratedIdentity (basic)Government IDFinancial accountPIIMediumContained

GRIFFON CORPORATION

bd_0b4709abab5b4b0a · schema v1 · pii pii-v1

Severity

Medium

Discovered

Sep 16, 2024

Filed

Sep 30, 2024

To disclose

14 days

Affected

Not disclosed

Confidence

64%

Full breach record for GRIFFON CORPORATION →

Griffon Corporation notified consumers of a data breach where an unauthorized third party accessed systems between June 15 and July 21, 2024. Personal information including names, SSNs, driver's licenses, and financial/health insurance data was potentially exposed. Griffon engaged cybersecurity experts and law enforcement, implemented security measures, and offered 24 months of identity theft protection.

J jump to incidentP pin to compareR raw source

Vermont clock✓ VT AG ≤14 bday14 days discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 93 days

discovery → filing · 14 days

Jun 15, 2024

Begins

Sep 16, 2024

Discovered

Sep 30, 2024

Filed

vs. sector median

9 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: GRIFFON CORPORATION
norm: griffon

Name: GRIFFON CORPORATION
norm: griffon
Industry: Manufacturingllm

Discovered: Sep 16, 2024
Breach occurred: Jun 15, 2024 – Jul 21, 2024
Undetected for: 93 daysoccurrence → discovery
Materiality determined: —
Notification sent: Sep 30, 2024
Affected individuals: Not disclosed
Data types: Identity (basic)Government IDFinancial accountPII
Data elements: Social Security numberDate of birth
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1119 Automated Collection
Threat actor: External
Regulator citations: working with law enforcement
Initial access: exploit_public_facing

During the incident: Undertook a review, working with third-party cybersecurity experts and law enforcement
Implemented additional security measures
Offering complimentary access to identity theft protection services through IDX for 24 months
Changes made: Implemented additional security measures to help further protect against this type of incident going forward
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 14 days(14 days from discovery to filing)
Compliance flags: VT AG ≤14 bday
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ago.vermont.gov/document/2024-09-30-griffon-corporation-data-breach-notice-consumers
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 30, 2024
Raw hash: 1318aa991b4467e59ea973c7d78139c1b13e11b009c18af902d9c2383cefb729

Reporting entityGRIFFON CORPORATION

Victim entityGRIFFON CORPORATION

Incidentdiscovered Sep 16, 2024

Stated responseUndertook a review, working with third-party cybersecurity experts and law enforcement

ComplianceVT AG ≤14 bday

Extraction provenanceno artifact recorded

Source provenanceago.vermont.gov