HackingManufacturingProfessional ServicesManufacturingVulnerability ExploitCapture Stored DataData ExfiltratedTargetedIdentity (basic)Government IDFinancial accountHealth (basic)EmploymentMediumContained

ALL STATES MATERIALS GROUP, INC.

bd_11094364dacbe72d · schema v1 · pii pii-v1

Severity

Medium

Discovered

Aug 25, 2025

Filed

Sep 23, 2025

To disclose

29 days

Affected

Not disclosed

Linked

6 records

Confidence

66%

Full breach record for ALL STATES MATERIALS GROUP, INC. →

All States Materials Group (ASMG) notified consumers and vendors of a cyberattack occurring August 22-25, 2025. The attacker exploited a vulnerability to access file directories containing payroll, employment, and vendor data. Affected data included names, SSNs, bank account numbers, and medical/safety info. ASMG engaged Blue Mantis for investigation, isolated servers, and implemented SOC and firewall hardening. 24 months of identity protection offered via IDX. No specific count of affected individuals disclosed.

J jump to incidentP pin to compareR raw source

Vermont clock⏱ VT AG >14 bday29 days discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 3 days

discovery → filing · 29 days

Aug 22, 2025

Begins

Aug 25, 2025

Discovered

Sep 23, 2025

Filed

This filing is one of 6 records about the same incident.View merged incident

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Siteplaybd_86d8ed62389d3b282025-08-25 · +29dVerified by operator

Regulatory filings (4) · sorted by filing gap

Massachusetts State AGbd_6a029fcf2a2376202025-09-23Verified by operator
New Hampshire State AGPlaybd_a5eea54fae198a322025-09-23Verified
Maine State AGbd_a6a0b09227782fa32025-09-23Candidate
Indiana State AGbd_c2c6c270aef69e542025-09-23Verified

Name: ALL STATES MATERIALS GROUP, INC.
norm: all states materials
Domain: asmg.com

Name: ALL STATES MATERIALS GROUP, INC.
norm: all states materials
Domain: asmg.com
Industry: ManufacturingllmProfessional Servicesllm

Discovered: Aug 25, 2025
Breach occurred: Aug 22, 2025 – Aug 25, 2025
Undetected for: 3 daysoccurrence → discovery
Materiality determined: —
Notification sent: Sep 23, 2025
Affected individuals: Not disclosed
Data types: Identity (basic)Government IDFinancial accountHealth (basic)Employment
Data elements: Social Security numberMedical information
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1119 Automated Collection
Threat actor: ExternalFinancial
Regulator citations: Notifying relevant state authorities
Initial access: exploit_public_facing

During the incident: Contacted Blue Mantis, ASMG’s independent cybersecurity investigation and recovery vendor
Secured servers from further unauthorized activity
Isolated all compromised servers
Implemented a series of security hardening measures
Implemented use of a fully monitored 24/7 SOC security solution
Reviewed and updated security configurations on all firewalls
Had a full review of M365 security settings performed by an outside firm
Engaged 3rd party security experts to perform ongoing reviews and testing of all IT infrastructure
Notifying relevant state authorities
Providing written notice to all individuals identified as having information potentially affected
Offering twenty-four (24) months of identity theft protection services through IDX
Changes made: Implemented a series of security hardening measures
Use of a fully monitored 24/7 SOC security solution
Reviewing and updating security configurations on all firewalls
Full review of M365 security settings performed by an outside firm
Engaged with 3rd party security experts to perform ongoing reviews and testing of all IT infrastructure
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 29 days(29 days from discovery to filing)
Compliance flags: VT AG >14 bday
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Massachusetts State AGSep 23 · first

New Hampshire State AGSep 23 · first

Maine State AGSep 23 · first

Indiana State AGSep 23 · first

Vermont State AGSep 23 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ago.vermont.gov/document/2025-09-23-all-states-materials-group-data-breach-notice-consumers
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 23, 2025
Raw hash: f9b75e181faef89a09f653532eb4206c29a28ce22b8f3653a9385a7d923ed543

Linked disclosures

Ransomware claims (1)

Regulatory filings (4) · sorted by filing gap

Reporting entityALL STATES MATERIALS GROUP, INC.

Victim entityALL STATES MATERIALS GROUP, INC.

Incidentdiscovered Aug 25, 2025

Stated responseContacted Blue Mantis, ASMG’s independent cybersecurity investigation and recovery vendor

ComplianceVT AG >14 bday

Extraction provenanceno artifact recorded

Source provenanceago.vermont.gov