MalwareManufacturingManufacturingRansomwareData ExfiltratedData PublishedCustomer Data InvolvedPIIIdentity (basic)LowContained

Shield Packaging Co., Inc.

bd_1c79191dc6bd915b · schema v1 · pii pii-v1

Severity

Low

Discovered

Apr 18, 2023

Filed

Nov 14, 2023

To disclose

30 weeks

Affected · nationwide

60021 in this filing

Linked

3 filings

Confidence

66%

Full breach record for Shield Packaging Co., Inc. →

Shield Packaging Co., Inc. experienced a ransomware attack on April 18, 2023. While initial forensic review found no evidence of exfiltration, attackers later posted confidential documents on a dark web site on August 24, 2023, suggesting potential access to other data. A subsequent review identified PII of approximately 600 individuals, including 21 New Hampshire residents, on affected systems. The company engaged forensic experts, notified the FBI, and is offering identity protection services.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 30 weeks / 210 days

Apr 18, 2023

Begins

Apr 18, 2023

Discovered

Nov 14, 2023

Filed

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Massachusetts State AGbd_6936be8592b6e6b02023-11-14Verified
Maine State AGbd_e40b98d722bd3e232023-11-14Candidate

Name: Shield Packaging Co., Inc.
norm: shield packaging

Name: Shield Packaging Co., Inc.
norm: shield packaging
Industry: Manufacturingllm

Discovered: Apr 18, 2023
Breach occurred: Apr 18, 2023
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Nov 14, 2023
Affected individuals: 600state + nationwide
Data types: PIIIdentity (basic)
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Notified the FBI of the incident

During the incident: Shutdown and rebuild its systems
Engaged a leading digital forensics expert to help them understand what had occurred
Monitor the dark web for any information that might have originated from their servers
Began a detailed review of the potentially impacted computers
Notified the FBI of the incident
Changes made: Implemented several key improvements to strengthen our security and resiliency
Offering identity theft protection services through IDX
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 30 weeks(210 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Massachusetts State AGNov 14 · first

Maine State AGNov 14 · first

New Hampshire State AGNov 14 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/shield-packaging-20231114.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 14, 2023
Raw hash: 670a6b75c1e3b6d0be5ca2302d9c675a32682fd4363417157991ae59162e7ca7

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityShield Packaging Co., Inc.

Victim entityShield Packaging Co., Inc.

Incidentdiscovered Apr 18, 2023

Stated responseShutdown and rebuild its systems

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov