Social EngineeringRetail & ConsumerRetailPhishingStolen CredentialsTargetedData ExfiltratedPIIIdentity (basic)LowContained

Wolseley Canada Inc 0/a Safe Step Walk In Tub

bd_1ae8c0f9f3a490ed · schema v1 · pii pii-v1

Severity

Low

Discovered

Dec 12, 2022

Filed

Mar 31, 2023

To disclose

16 weeks

Affected

13state residents only

Confidence

64%

Full breach record for Wolseley Canada Inc 0/a Safe Step Walk In Tub →

Wolseley Canada Inc. o/a Safe Step Walk In Tub notified Montana residents of a data breach where unauthorized third parties accessed a single employee's email inbox between Oct 25 and Dec 12, 2022. The incident involved potential exposure of personal information (names, data elements). Safe Step terminated access, engaged forensic investigators, reported to law enforcement, and provided 12 months of identity monitoring via Kroll.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 48 days

discovery → filing · 16 weeks / 109 days

Oct 25, 2022

Begins

Dec 12, 2022

Discovered

Mar 31, 2023

Filed

vs. sector median

+6 wks slower

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed13 affectedView incident

Name: Wolseley Canada Inc 0/a Safe Step Walk In Tub
norm: wolseley canada inc 0 a safe step walk in tub
Domain: safesteptub.com

Name: Wolseley Canada Inc 0/a Safe Step Walk In Tub
norm: wolseley canada inc 0 a safe step walk in tub
Domain: safesteptub.com
Industry: Retail & Consumerllm

Discovered: Dec 12, 2022
Breach occurred: Oct 25, 2022 – Dec 12, 2022
Undetected for: 48 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 13state-resident count only
Data types: PIIIdentity (basic)
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid AccountsT1114 Email Collection
Threat actor: External
Regulator citations: Reported the incident to law enforcement
Initial access: phishing_link

During the incident: Initiated a cybersecurity response and launched an investigation
Engaged a cybersecurity firm to assist in investigating the incident
Successfully terminated the unauthorized access
Reported the incident to law enforcement
Changes made: Working to identify vulnerabilities in our systems and implement appropriate remedial action
Accelerating efforts to further harden our environment through various enhancements and other security measures
Utilizing information revealed in the analysis of this incident to further strengthen the security of our network, systems and information
Provided 12 months of complimentary identity monitoring services through Kroll
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 16 weeks(109 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-notification-letter-161.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 31, 2023
Raw hash: 90b3a2304b5b5b00346627e43751b1a29f0e1ce1fa4793036888bfd59d2543d7

Reporting entityWolseley Canada Inc 0/a Safe Step Walk In Tub

Victim entityWolseley Canada Inc 0/a Safe Step Walk In Tub

Incidentdiscovered Dec 12, 2022

Stated responseInitiated a cybersecurity response and launched an investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov