HackingManufacturingCustomer Data InvolvedData ExfiltratedDelayed DiscoveryIdentity (basic)Government IDHighContained

PGT Innovations, Inc.

bd_16bd95df5aef0536 · schema v1 · pii pii-v1

Severity

High

Discovered

Mar 3, 2023

Filed

Apr 3, 2023

To disclose

4 weeks

Affected · nationwide

6,0201 in this filing

Linked

7 filings

Confidence

65%

Full breach record for PGT Innovations, Inc. →

PGT Innovations experienced an external system breach between October 13, 2022, and November 29, 2022, discovered on March 3, 2023. The breach compromised names and Social Security numbers. The company began notifying affected individuals on April 3, 2023, and offered 12 months of credit monitoring services through Experian.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Mar 3, 2023 → Filed with AG Apr 3, 202331d ⏱ ME AG >30d4 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 141 days

discovery → filing · 4 weeks / 31 days

Oct 13, 2022

Begins

Mar 3, 2023

Discovered

Apr 3, 2023

Filed

This filing is one of 7 about the same incident.View merged incident

A leak claim by blacksuit about this victim predates this filing by 122 days.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (2)

Leak Siteblacksuitbd_c46d0405bf3ad1ce2022-12-16 · +108dVerified by operator
Leak Siteblacksuitbd_5ae910eea47508eb2022-12-02 · +122dVerified by operator

Regulatory filings (4) · sorted by filing gap

Indiana State AGbd_3a255097d21ed31b2023-04-03Verified
California State AGbd_c27185b56d90bee82023-04-03Verified by operator
SEC 8-Kbd_f2e2d638ada8335a2023-04-06 · +3dVerified by operator
Massachusetts State AGbd_4a66f40503b4c1bc2023-04-07 · +4dVerified by operator

Name: PGT Innovations, Inc.
norm: pgt innovations
Domain: pgtinnovations.com

Name: PGT Innovations, Inc.
norm: pgt innovations
Domain: pgtinnovations.com

Discovered: Mar 3, 2023
Breach occurred: Oct 13, 2022 – Nov 29, 2022
Undetected for: 141 daysoccurrence → discovery
Materiality determined: —
Notification sent: Apr 3, 2023
Affected individuals: 6,020state + nationwide
Data types: Identity (basic)Government ID
Data elements: Social Security number
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External

During the incident: Offered 12 months of monitoring services through Experian
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 4 weeks(31 days from discovery to filing)
Compliance flags: ME AG >30d · 31dLeak >90d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Mar 3, 2023
→ Filed with AG: Apr 3, 2023
31d 30 days (soft) ME AG >30d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Mar 3, 2023 → Filed with AG: Apr 3, 2023	31d	30 days (soft)	ME AG >30d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 4 states

View merged incident ↗

Indiana State AGApr 3 · first

California State AGApr 3 · first

Maine State AGApr 3 · first · this page

SEC 8-K+3d

Massachusetts State AG+4d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/f3c285b4-5121-49f4-870c-e1a5b2e1548c.shtml
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 3, 2023
Raw hash: 068463e95b3145b269403cdc0fc69bc7ed3f56a118dae058b0977c63036a3f1d

Linked disclosures

Ransomware claims (2)

Regulatory filings (4) · sorted by filing gap

Reporting entityPGT Innovations, Inc.

Victim entityPGT Innovations, Inc.

Incidentdiscovered Mar 3, 2023

Stated responseOffered 12 months of monitoring services through Experian

ComplianceME AG >30d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov