MalwareOtherRansomwareStolen CredentialsData ExfiltratedData EncryptedCustomer Data InvolvedDelayed DiscoveryIdentity (basic)Government IDMediumContained

American Trading and Production Corporation

bd_0e360421d505eb31 · schema v1 · pii pii-v1

Severity

Medium

Discovered

May 4, 2022

Filed

Nov 10, 2023

To disclose

19 months

Affected

4state residents only

Linked

3 filings

Confidence

66%

Full breach record for American Trading and Production Corporation →2 incidents on file

American Trading and Production Corporation (ATAPCO) disclosed a ransomware incident affecting 4 New Hampshire residents. Unauthorized access occurred between Feb 17 and May 5, 2022. ATAPCO detected suspicious activity on May 4, 2022. The breach involved malware infection and data exfiltration. Notices were sent on Nov 10, 2023, offering 24 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 76 days

discovery → filing · 19 months / 555 days

Feb 17, 2022

Begins

May 4, 2022

Discovered

Nov 10, 2023

Filed

vs. sector median

+71 wks slower

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Maine State AGbd_169dcde121c93eda2023-11-10Candidate
Vermont State AGbd_9e3ee27bb58aba0a2023-11-10Verified

Name: American Trading and Production Corporation
norm: american trading and production

Name: American Trading and Production Corporation
norm: american trading and production
Industry: Otherllm

Discovered: May 4, 2022
Breach occurred: Feb 17, 2022 – May 5, 2022
Undetected for: 76 daysoccurrence → discovery
Materiality determined: —
Notification sent: Nov 10, 2023
Affected individuals: 4state-resident count only
Data types: Identity (basic)Government ID
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Notified law enforcement regarding the eventProviding written notice of this incident to relevant state regulators
Initial access: valid_credentials

During the incident: Moved to investigate and respond to the incident
Assessed the security of ATAPCO systems
Identified potentially affected individuals
Notified law enforcement regarding the event
Worked with third-party forensic specialists to investigate the nature and scope of the activity
Provided access to credit monitoring services for impacted individuals
Provided impacted individuals with guidance on how to better protect against identity theft and fraud
Changes made: Implementing additional safeguards and training to its employees
Implementing additional technical security measures to strengthen the security of our systems
Reviewing and enhancing our existing data privacy policies and procedures
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 19 months(555 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Maine State AGNov 10 · first

Vermont State AGNov 10 · first

New Hampshire State AGNov 10 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/american-trading-production-corporation-20231110.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 10, 2023
Raw hash: 1da12ba2358c8a2876e47a0618d2a0a01f730aa7776de7139d4bca479c486089

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityAmerican Trading and Production Corporation

Victim entityAmerican Trading and Production Corporation

Incidentdiscovered May 4, 2022

Stated responseMoved to investigate and respond to the incident

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov