HackingOtherStolen CredentialsData ExfiltratedIdentity (basic)Government IDMediumContained

Anvil Corporation

bd_114fba00f787b3b0 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Apr 12, 2021

Filed

Apr 30, 2021

To disclose

18 days

Affected

70state residents only

Linked

2 filings

Confidence

66%

Full breach record for Anvil Corporation →

Anvil Corporation notified Montana residents of a security breach where an unauthorized third party accessed the network and downloaded documents containing names and Social Security Numbers of current and former employees. The incident was discovered on April 12, 2021, following a forensic investigation. Anvil contained the breach and offered one year of Experian IdentityWorks credit monitoring to affected individuals.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 18 days

Apr 12, 2021

Discovered

Apr 30, 2021

Filed

vs. sector median

5 wks faster

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Indiana State AGbd_821cea0957c867582021-04-30Verified

Name: Anvil
norm: anvil
Domain: anvil.works

Name: Anvil Corporation
norm: anvil
Domain: anvilcorp.com
Industry: Otherllm

Discovered: Apr 12, 2021
Materiality determined: —
Notification sent: Apr 30, 2021
Affected individuals: 70state-resident count only
Data types: Identity (basic)Government ID
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1119 Automated Collection
Threat actor: External
Initial access: valid_credentials

During the incident: Took steps to expel the unauthorized party and contain the incident
Initiated an internal investigation
Hired a leading computer forensics firm to examine our network
Arranged for a complimentary one-year membership of Experian IdentityWorks SM Credit 3B for all those who were potentially impacted
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 18 days(18 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Indiana State AGApr 30 · first

Montana State AGApr 30 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/Anvil-Notif.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 30, 2021
Raw hash: 2a9231aa845a80bef2629b081c9885d519ebca23824543b2b59ef2b2038d52f4

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityAnvil

Victim entityAnvil Corporation

Incidentdiscovered Apr 12, 2021

Stated responseTook steps to expel the unauthorized party and contain the incident

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov