DisclosureLens
HackingRetail & ConsumerRetailCustomer Data InvolvedDelayed DiscoveryFinancial accountFinancial credentialsMediumContained

Hammond Lumber Company

bd_0eb9d39c5c342129 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Apr 23, 2023

Filed

May 16, 2023

To disclose

23 days

Affected · nationwide

2,0921,980 in this filing

Linked

6 filings

Confidence

65%
Full breach record for Hammond Lumber Company

Hammond Lumber Company reported a data breach that occurred on March 22, 2023, and was discovered on April 23, 2023. The breach affected 2,092 individuals, including 1,980 Maine residents. The compromised information included names in combination with financial account or credit/debit card numbers and their associated security codes or PINs. Affected individuals were notified on May 15, 2023, and offered 12 months of identity theft and credit monitoring services through Experian.

Leak gap clock Leak >30d23 days discovery → filing
AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 32 days
discovery → filing · 23 days

Mar 22, 2023

Begins

Apr 23, 2023

Discovered

May 16, 2023

Filed

vs. sector median

4 wks faster

This filing is one of 6 about the same incident.View merged incident
A leak claim by lockbit_3 about this victim predates this filing by 48 days.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (1)

Regulatory filings (4) · sorted by filing gap

Filing propagation · 5 filings · 4 states

View merged incident ↗
Maine State AGApr 20 · first
Maine State AG+26d · this page

Pattern: first filing Apr 20 (ME), last May 25 (NH) — a 35-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.