HackingVulnerability ExploitCapture Stored DataData ExfiltratedTargetedIDENTITY_BASICIDENTITY_GOVERNMENTMediumContained
GRAPHIC PACKAGING INTERNATIONAL, LLC
bd_121af29fed1045f0 · schema v1 · pii pii-v1
Full breach record for GRAPHIC PACKAGING INTERNATIONAL, LLC →Welltok, Inc. notified Graphic Packaging International that an unknown actor exploited vulnerabilities in the MOVEit Transfer server on May 30, 2023, to exfiltrate data including names and government IDs. The incident was discovered on July 26, 2023, and notifications were sent in November 2023. Welltok engaged third-party cybersecurity specialists and is offering credit monitoring services.
Vermont clock✗ VT AG >45 bday17 weeks discovery → filing
⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
This filing is one of 2 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (1) · sorted by filing gap
- bd_6a7f1564e73ac67cCalifornia State AGfiled 2023-11-22Candidate
Source provenance
- Source URL
- https://ago.vermont.gov/document/2023-11-22-graphic-packaging-international-data-breach-notice-consumers
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Nov 22, 2023
- Raw hash
- b362285a4c40aa9dc82dd2610cc301f21a1ea05cfbc8d49a4010806bd0ad03ef
Reporting entity
- Name
- Welltoknorm: welltok
- Domain
- welltok.com
Victim entity
- Name
- GRAPHIC PACKAGING INTERNATIONAL, LLCnorm: graphic packaging
Incident
- Discovered
- Jul 26, 2023
- Materiality determined
- Oct 18, 2023
- Notification sent
- Nov 21, 2023
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENT
- Attack vector
- Misconfiguration
- MITRE ATT&CK
- T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 Channel
- Threat actor
- ExternalFinancial
- Initial access
- exploit_public_facing
Compliance
- Time to disclose
- 17 weeks(119 days from discovery to filing)
- Compliance flags
- VT AG >45 bday
- Discovery-date grounding
- unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.