HackingRetail & ConsumerRetailStolen CredentialsCustomer Data InvolvedIdentity (basic)Financial accountLowContained

CORNERSTONE BUILDING BRANDS, INC.

bd_1bb36690f91eb344 · schema v1 · pii pii-v1

Severity

Low

Discovered

Apr 2, 2019

Filed

Apr 8, 2020

To disclose

12 months

Affected

9state residents only

Confidence

66%

Full breach record for CORNERSTONE BUILDING BRANDS, INC. →3 incidents on file

Cornerstone Building Brands filed a supplemental notice with the NH AG regarding a security incident where an unauthorized person accessed two employee email accounts between April 1-2, 2019. The incident exposed names, financial account numbers, and payment card numbers of 9 NH residents. The company engaged a cybersecurity firm, secured accounts, and provided one year of identity monitoring via Kroll.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 1 days

discovery → filing · 12 months / 372 days

Apr 1, 2019

Begins

Apr 2, 2019

Discovered

Apr 8, 2020

Filed

vs. sector median

+46 wks slower

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed9 affectedView incident

Name: CORNERSTONE BUILDING BRANDS, INC.
norm: cornerstone building brands

Name: CORNERSTONE BUILDING BRANDS, INC.
norm: cornerstone building brands
Industry: Retail & Consumerllm

Discovered: Apr 2, 2019
Breach occurred: Apr 1, 2019 – Apr 2, 2019
Undetected for: 1 dayoccurrence → discovery
Materiality determined: —
Notification sent: Apr 7, 2020
Affected individuals: 9state-resident count only
Data types: Identity (basic)Financial account
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: Notified Attorney General's office on September 11, 2019
Initial access: valid_credentials

During the incident: Took steps to secure the accounts
Launched an investigation
A cyber security firm was engaged to assist
Conducted a thorough review of the emails and attachments
Changes made: Providing additional data-security training to employees
Enhancing existing security measures
Arranged for Kroll to provide identity monitoring at no cost to you for one year
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 12 months(372 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/cornerstone-building-brands-20200408.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 8, 2020
Raw hash: f2e04080362a709f38edd9833a9351bb024be61985dc2dad670ab32b4516dba1

Reporting entityCORNERSTONE BUILDING BRANDS, INC.

Victim entityCORNERSTONE BUILDING BRANDS, INC.

Incidentdiscovered Apr 2, 2019

Stated responseTook steps to secure the accounts

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov