MalwareRansomwareData ExfiltratedRansom DemandedRansom PaidEmployee Data InvolvedGovernment IDIdentity (basic)EmploymentMediumContained

Faneuil, Inc.

bd_125d95dc09b67ece · schema v1 · pii pii-v1

Severity

Medium

Discovered

Aug 18, 2021

Filed

Feb 7, 2022

To disclose

25 weeks

Affected

Not disclosed

Linked

3 filings

Confidence

64%

Full breach record for Faneuil, Inc. →

Faneuil, Inc. disclosed a ransomware attack discovered on August 18, 2021. Attackers accessed and copied employment records (including SSNs) of past and present employees prior to encrypting systems. Faneuil paid the ransom and received confirmation that copied data was destroyed. The company isolated systems, engaged forensic experts, and offered 24 months of identity monitoring to affected individuals.

J jump to incidentP pin to compareR raw source

California clockDiscovered Aug 18, 2021 → Notified Feb 1, 2022167d ✗ CA 60-day late25 weeks discovery → filing

Incident timeline

undetected · 119 days

discovery → filing · 25 weeks / 173 days

Apr 21, 2021

Begins

Aug 18, 2021

Discovered

Feb 7, 2022

Filed

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Delaware State AGbd_08fd1bcfc2254b582022-02-08 · +1dCandidate
Delaware State AGbd_06d0fd77be8a70412022-02-01 · +6dCandidate

Name: Faneuil, Inc.
norm: faneuil
Domain: faneuil.com

Name: Faneuil, Inc.
norm: faneuil
Domain: faneuil.com

Discovered: Aug 18, 2021
Breach occurred: Apr 21, 2021
Undetected for: 119 daysoccurrence → discovery
Materiality determined: —
Notification sent: Feb 1, 2022
Affected individuals: Not disclosed
Data types: Government IDIdentity (basic)Employment
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Reported the incident to and cooperated with law enforcement

During the incident: Isolated all impacted systems to disrupt the attack and prevent further access
Engaged independent cybersecurity experts to investigate the causes and impacts
Engaged an independent data risk protection firm to facilitate communications with the attackers
Paid the attackers and received confirmation that they destroyed all copied information
Reported the incident to and cooperated with law enforcement
Implemented additional information security measures
Rebuilt systems to prevent any persistence of these attackers
Offered a 24-month membership in Experian IdentityWorks
Changes made: Implemented additional information security measures
Rebuilt systems to prevent any persistence of these attackers and to prevent similar future incidents
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 25 weeks(173 days from discovery to filing)
Compliance flags: CA 60-day late · 167d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Aug 18, 2021
→ Notified: Feb 1, 2022
167d 60 days (analyst band, pre-2026 discoveries) CA 60-day late

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Aug 18, 2021 → Notified: Feb 1, 2022	167d	60 days (analyst band, pre-2026 discoveries)	CA 60-day late

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 2 states

View merged incident ↗

Delaware State AGFeb 1 · first

California State AG+6d · this page

Delaware State AG+7d

Pattern: first filing Feb 1 (DE), last Feb 8 (DE) — a 7-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-550731
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 7, 2022
Raw hash: 52887aadc1d8843c4c3e1249d132c0ad87bf371fbc17e37fec9e13fc38252c57

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityFaneuil, Inc.

Victim entityFaneuil, Inc.

Incidentdiscovered Aug 18, 2021

Stated responseIsolated all impacted systems to disrupt the attack and prevent further access

ComplianceCA 60-day late

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov