UnknownTransportation & LogisticsTransportationEmployee Data InvolvedData PublishedIdentity (basic)Government IDEmploymentMediumActive

MAXCO SUPPLY, INC.

bd_1efcbf8c04aedb2a · schema v1 · pii pii-v1

Severity

Medium

Discovered

Dec 8, 2023

Filed

Dec 28, 2023

To disclose

20 days

Affected

Not disclosed

Linked

2 filings

Confidence

64%

Full breach record for MAXCO SUPPLY, INC. →

Maxco Supply, Inc. notified employees on Dec 28, 2023, that confidential information (names, SSNs, DOBs, addresses, tax/employment data) for past and present employees may have been released on the Dark Web between July and Oct 2023. The incident was discovered on Dec 8, 2023, when an employee reported a letter indicating the exposure. The source of the breach is unknown; Maxco retained cybersecurity experts, notified the FBI, and is reviewing controls. No specific attack vector or threat actor was identified.

J jump to incidentP pin to compareR raw source

Leak gap clock⏱ Leak >30d20 days discovery → filing

Incident timeline

undetected · 160 days

discovery → filing · 20 days

Jul 1, 2023

Begins

Dec 8, 2023

Discovered

Dec 28, 2023

Filed

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Sitemoneymessagebd_aa9d6b31716252b12023-10-03 · +86dVerified by operator

Name: MAXCO SUPPLY, INC.
norm: maxco supply

Name: MAXCO SUPPLY, INC.
norm: maxco supply
Industry: Transportation & Logisticsllm

Discovered: Dec 8, 2023
Breach occurred: Jul 1, 2023 – Oct 31, 2023
Undetected for: 160 daysoccurrence → discovery
Materiality determined: —
Notification sent: Dec 28, 2023
Affected individuals: Not disclosed
Data types: Identity (basic)Government IDEmployment
Data elements: Social Security numberDate of birth
Attack vector: Unknown
Regulator citations: Notified the FBI, and the appropriate state authorities of this incident

During the incident: Notified all current Maxco employees (via e-mail and postings at the facilities) of this potential problem
Retained the assistance of cybersecurity experts to ensure that Maxco’s electronic systems are secure and to identify the source, if any, of the breach of security
Reviewing company policies and procedures to ensure that the appropriate controls are in place and to prevent future occurrences
Engaging security specialists to assess Maxco’s controls and help implement additional safeguards as needed
Notified the FBI, and the appropriate state authorities of this incident
Changes made: Reviewing company policies and procedures to ensure that the appropriate controls are in place and to prevent future occurrences
Engaging security specialists to assess Maxco’s controls and help implement additional safeguards as needed
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 20 days(20 days from discovery to filing)
Compliance flags: Leak >30dCA 60-day OK · 20d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Dec 8, 2023
→ Notified: Dec 28, 2023
20d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Dec 8, 2023 → Notified: Dec 28, 2023	20d	60 days (analyst band, pre-2026 discoveries)	CA 60-day OK

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-578536
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 28, 2023
Raw hash: 416600ee89740ae66120a3338fc0f300f283c6e3ac33b9068f1ee41104b552ce

Linked disclosures

Ransomware claims (1)

Reporting entityMAXCO SUPPLY, INC.

Victim entityMAXCO SUPPLY, INC.

Incidentdiscovered Dec 8, 2023

Stated responseNotified all current Maxco employees (via e-mail and postings at the facilities) of this potential problem

ComplianceLeak >30d

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov