MalwareTransportation & LogisticsTransportationRansomwareData ExfiltratedData EncryptedRansom DemandedIdentity (basic)Government IDMediumContained

Valley Regional Transit

bd_1d005beea990e207 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Oct 14, 2021

Filed

Jan 21, 2022

To disclose

14 weeks

Affected

3state residents only

Linked

4 filings

Confidence

66%

Full breach record for Valley Regional Transit →

Valley Regional Transit suffered a ransomware attack on October 14, 2021. Attackers exfiltrated data including names, DOBs, addresses, and SSNs/driver's license numbers before encrypting systems. VRT engaged legal counsel and forensic experts, notified the FBI and TSA, and offered one year of Experian credit monitoring. Remediation included enhanced network security, IDS installation, and patch management improvements.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 14 weeks / 99 days

Oct 14, 2021

Begins

Oct 14, 2021

Discovered

Jan 21, 2022

Filed

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Massachusetts State AGbd_4f4d74fbdd5c0fb72022-01-25 · +4dVerified
Idaho State AGbd_5bbda4e6f2ce65d82022-01-14 · +7dVerified
Idaho State AGLockBit 2.0bd_76e9b90595f5b3242021-10-19 · +94dCandidate

Name: Valley Regional Transit
norm: valley regional transit

Name: Valley Regional Transit
norm: valley regional transit
Industry: Transportation & Logisticsllm

Discovered: Oct 14, 2021
Breach occurred: Oct 14, 2021
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jan 21, 2022
Affected individuals: 3state-resident count only
Data types: Identity (basic)Government ID
Data elements: Date of birth
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Notified the Federal Bureau of InvestigationNotified the Transportation Security AdministrationProviding regular updates about this incident to the Idaho Chief Information Security Officer, Attorney General, Chief Information Officer and Office of Risk Management

During the incident: Started working with legal counsel with expertise in cybersecurity
Hired nationally-recognized cyber security experts to assist with the investigation
Worked closely with its experts to understand what happened, contain the attack, and determine whether the incident involved personal information
Notified the Federal Bureau of Investigation and the Transportation Security Administration
Providing regular updates about this incident to the Idaho Chief Information Security Officer, Attorney General, Chief Information Officer and Office of Risk Management
Offering complimentary, one-year membership with Experian
Changes made: Enhancing security so that we can limit and restrict access to our computer network
Installing an intrusion detection system that monitors for malicious activity
Patching identified system vulnerabilities
Enhancing patch management procedures to ensure that patches are promptly deployed
Reviewing our network to ensure that personal information is stored in secure areas designated for sensitive information
Implementing greater security for VRT administrator accounts used to manage our network
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 14 weeks(99 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 3 states

View merged incident ↗

Idaho State AGOct 19 · first

Idaho State AG+87d

Montana State AG+94d · this page

Massachusetts State AG+98d

Pattern: first filing Oct 19 (ID), last Jan 25 (MA) — a 98-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/Valley-Regional-Transit-Consumer-Notification-Letter.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 21, 2022
Raw hash: 7cfe498d8633fe6610382c5a0d85fea0578af5fbf7365c7dd3b2df00cae89c15

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityValley Regional Transit

Victim entityValley Regional Transit

Incidentdiscovered Oct 14, 2021

Stated responseStarted working with legal counsel with expertise in cybersecurity

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov