HackingManufacturingManufacturingTargetedIdentity (basic)Government IDHighContained

EASTERN SHIPBUILDING GROUP, INC.

bd_18052bc17fe5f6b5 · schema v1 · pii pii-v1

Severity

High

Discovered

Feb 4, 2024

Filed

Oct 21, 2024

To disclose

37 weeks

Affected · nationwide

2,9582 in this filing

Linked

5 filings

Confidence

66%

Full breach record for EASTERN SHIPBUILDING GROUP, INC. →

Eastern Shipbuilding Group reported an external system breach (hacking) affecting 2,958 individuals, including 2 Maine residents. The breach occurred on Feb 1, 2024, and was discovered on Feb 4, 2024. Compromised data included names and Social Security numbers. Notifications were sent starting June 28, 2024, with credit monitoring offered.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Feb 4, 2024 → Filed with AG Oct 21, 2024260d ✗ ME AG >90d37 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 3 days

discovery → filing · 37 weeks / 260 days

Feb 1, 2024

Begins

Feb 4, 2024

Discovered

Oct 21, 2024

Filed

vs. sector median

+26 wks slower

This filing is one of 5 about the same incident.View merged incident

A leak claim by lockbit_3 about this victim predates this filing by 261 days.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Sitelockbit_3bd_b213663903a8a85a2024-02-03 · +261dVerified

Regulatory filings (3) · sorted by filing gap

New Hampshire State AGbd_fe3e9933ddba036c2024-10-22 · +1dVerified
Maine State AGbd_237252f23b796b152024-06-28 · +115dVerified
Indiana State AGbd_4ec134c7648b67502024-06-28 · +115dVerified

Name: EASTERN SHIPBUILDING GROUP, INC.
norm: eastern shipbuilding
Domain: easternshipbuilding.com

Name: EASTERN SHIPBUILDING GROUP, INC.
norm: eastern shipbuilding
Domain: easternshipbuilding.com
Industry: Manufacturingllm

Discovered: Feb 4, 2024
Breach occurred: Feb 1, 2024
Undetected for: 3 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jun 28, 2024
Affected individuals: 2,958state + nationwide
Data types: Identity (basic)Government ID
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1078 Valid Accounts
Threat actor: External
Regulator citations: providing written notice of this incident to relevant state regulators
Initial access: exploit_public_facing

During the incident: Launched an investigation with the assistance of third-party forensic specialists
Notified federal law enforcement
Provided employees with complementary credit monitoring
Providing access to credit monitoring services for one (1) year, through Experian
Changes made: Working to implement additional safeguards and training to its employees
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 37 weeks(260 days from discovery to filing)
Compliance flags: ME AG >90d · 260dLeak >180dME resident >60d · 145d
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Feb 4, 2024
→ Filed with AG: Oct 21, 2024
260d 90 days ME AG >90d
Maine
Discovered: Feb 4, 2024
→ Notified: Jun 28, 2024
145d 60 days (analyst band; statutory cap is 30 days) ME resident >60d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Feb 4, 2024 → Filed with AG: Oct 21, 2024	260d	90 days	ME AG >90d
Maine	Discovered: Feb 4, 2024 → Notified: Jun 28, 2024	145d	60 days (analyst band; statutory cap is 30 days)	ME resident >60d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 3 states

View merged incident ↗

Maine State AGJun 28 · first

Indiana State AGJun 28 · first

Maine State AG+115d · this page

New Hampshire State AG+116d

Pattern: first filing Jun 28 (ME), last Oct 22 (NH) — a 116-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/5b448148-488f-4e85-aabf-3eadbbc682ff.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 21, 2024
Raw hash: 3dd760c7cc7baccd6c249e06ae5af0c020814372bfc039111e88991d737a4907

Linked disclosures

Ransomware claims (1)

Regulatory filings (3) · sorted by filing gap

Reporting entityEASTERN SHIPBUILDING GROUP, INC.

Victim entityEASTERN SHIPBUILDING GROUP, INC.

Incidentdiscovered Feb 4, 2024

Stated responseLaunched an investigation with the assistance of third-party forensic specialists

ComplianceME AG >90d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov