HackingRetail & ConsumerRetailStolen CredentialsCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDCredentialsMediumContained

Summit Truck Group

bd_144689724f3d5dd2 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Mar 7, 2022

Filed

May 31, 2022

To disclose

12 weeks

Affected

1state residents only

Linked

2 filings

Confidence

65%

Full breach record for Summit Truck Group →

Summit Truck Group notified Montana employees of a data breach involving unauthorized access to former systems. Threat actors accessed personal data (SSN, DL, DOB) and credentials. Incident discovered March 7, 2022. Company engaged forensic experts and offered 24 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 96 days

discovery → filing · 12 weeks / 85 days

Dec 1, 2021

Begins

Mar 7, 2022

Discovered

May 31, 2022

Filed

vs. sector median

+5 wks slower

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Indiana State AGbd_f25cadb53bde5a1f2022-05-26 · +5dVerified

Name: Summit Truck Group
norm: summit truck

Name: Summit Truck Group
norm: summit truck
Industry: Retail & Consumerllm

Discovered: Mar 7, 2022
Breach occurred: Dec 1, 2021 – Dec 31, 2021
Undetected for: 96 daysoccurrence → discovery
Materiality determined: —
Notification sent: Mar 15, 2022
Affected individuals: 1state-resident count only
Data types: Identity (basic)Government IDCredentials
Data elements: Social Security numberDate of birth
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1114 Email Collection
Threat actor: ExternalFinancial
Initial access: valid_credentials

During the incident: Engaged industry-leading third-party cybersecurity experts to respond to and investigate this incident
Deployed advanced endpoint threat detection and prevention and mitigation tools
Continuing to monitor for evidence that personal information may have been distributed
Offered 24 months of credit monitoring services through TransUnion
Changes made: Offered 24 months of complimentary credit monitoring and identity theft protection through TransUnion
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 12 weeks(85 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Indiana State AGMay 26 · first

Montana State AG+5d · this page

Pattern: first filing May 26 (IN), last May 31 (MT) — a 5-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-Notification-Letter-458.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 31, 2022
Raw hash: c90c363975d08c38165f11886b6fd72bd3b477c280e3c094b275262c3cca75c0

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entitySummit Truck Group

Victim entitySummit Truck Group

Incidentdiscovered Mar 7, 2022

Stated responseEngaged industry-leading third-party cybersecurity experts to respond to and investigate this incident

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov