Social EngineeringRetail & ConsumerRetailPhishingStolen CredentialsCustomer Data InvolvedTargetedPIIIdentity (basic)LowContained

The James Campbell Company LLC

bd_15ee4d4f5f5ecdca · schema v1 · pii pii-v1

Severity

Low

Discovered

Apr 19, 2023

Filed

Jul 31, 2023

To disclose

15 weeks

Affected

2state residents only

Confidence

65%

Full breach record for The James Campbell Company LLC →

The James Campbell Company LLC notified Montana residents of a cyber incident where an unauthorized actor accessed an employee email account between March 27 and April 20, 2023, following suspicious activity detected on April 19, 2023. The actor potentially acquired names and other personal data. The company secured the email tenant, investigated, notified regulators, and offered 24 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 23 days

discovery → filing · 15 weeks / 103 days

Mar 27, 2023

Begins

Apr 19, 2023

Discovered

Jul 31, 2023

Filed

vs. sector median

+5 wks slower

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed2 affectedView incident

Name: The James Campbell Company LLC
norm: the james campbell

Name: The James Campbell Company LLC
norm: the james campbell
Industry: Retail & Consumerllm

Discovered: Apr 19, 2023
Breach occurred: Mar 27, 2023 – Apr 20, 2023
Undetected for: 23 daysoccurrence → discovery
Materiality determined: —
Notification sent: Oct 1, 2023
Affected individuals: 2state-resident count only
Data types: PIIIdentity (basic)
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid AccountsT1114 Email Collection
Threat actor: External
Regulator citations: notified state regulators, as required
Initial access: phishing_link

During the incident: Immediately took steps to secure our email tenant
Launched an investigation to determine the nature and scope of the incident
Working to implement additional security measures to further protect against similar incidents in the future
Notified state regulators, as required
Offer you twenty-four months of complimentary access to credit monitoring services through Experian
Changes made: Working to implement additional security measures to further protect against similar incidents in the future
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 15 weeks(103 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-notification-letter-494.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 31, 2023
Raw hash: cf061ffe96f329f641940673e42d3273c3865b33f178d7fab1c04650ce701417

Reporting entityThe James Campbell Company LLC

Victim entityThe James Campbell Company LLC

Incidentdiscovered Apr 19, 2023

Stated responseImmediately took steps to secure our email tenant

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov