HackingManufacturingManufacturingCustomer Data InvolvedData ExfiltratedGovernment IDIdentity (basic)HighContained

Continental AG

bd_1f28c8201f71190e · schema v1 · pii pii-v1

Severity

High

Discovered

Aug 4, 2022

Filed

Aug 23, 2023

To disclose

13 months

Affected · nationwide

5,3652 in this filing

Linked

6 filings

Confidence

66%

Full breach record for Continental AG →

Continental AG, a German commercial entity, reported an external system breach (hacking) occurring between July 1, 2022, and August 5, 2022. The incident compromised the names and Social Security Numbers of 5,365 individuals, including 2 Maine residents. The breach was discovered on August 4, 2022. Continental AG provided written notification to affected consumers on August 15, 2023, and offered 24 months of credit monitoring through Cyberscout.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Aug 4, 2022 → Filed with AG Aug 23, 2023384d ✗ ME AG >90d13 months discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 34 days

discovery → filing · 13 months / 384 days

Jul 1, 2022

Begins

Aug 4, 2022

Discovered

Aug 23, 2023

Filed

vs. sector median

+44 wks slower

This filing is one of 6 about the same incident.View merged incident

A leak claim by lockbit_3 about this victim predates this filing by 293 days.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Sitelockbit_3bd_9a67e1924b63f9012022-11-03 · +293dVerified by operator

Regulatory filings (4) · sorted by filing gap

New Hampshire State AGbd_ae3ea6f655cb60d02023-08-24 · +1dVerified
Massachusetts State AGbd_aa99fac47ed47ab52023-08-28 · +5dVerified by operator
Vermont State AGbd_170f8e9c933666b42023-08-15 · +8dVerified
Indiana State AGbd_94bcefd814e9f6b92023-08-15 · +8dVerified

Name: Continental AG
norm: continental
Domain: continental.com

Name: Continental AG
norm: continental
Domain: continental.com
Industry: Manufacturingllm

Discovered: Aug 4, 2022
Breach occurred: Jul 1, 2022 – Aug 5, 2022
Undetected for: 34 daysoccurrence → discovery
Materiality determined: —
Notification sent: Aug 15, 2023
Affected individuals: 5,365state + nationwide
Data types: Government IDIdentity (basic)
Data elements: Social Security number
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: External
Regulator citations: Filed data breach notice with Maine Attorney General
Initial access: exploit_public_facing

During the incident: Sent written notification to affected consumers
Offered 24 months of credit monitoring provided by Cyberscout
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 13 months(384 days from discovery to filing)
Compliance flags: ME AG >90d · 384dME resident >180d · 376dLeak >180d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Aug 4, 2022
→ Filed with AG: Aug 23, 2023
384d 90 days ME AG >90d
Maine
Discovered: Aug 4, 2022
→ Notified: Aug 15, 2023
376d 180 days ME resident >180d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Aug 4, 2022 → Filed with AG: Aug 23, 2023	384d	90 days	ME AG >90d
Maine	Discovered: Aug 4, 2022 → Notified: Aug 15, 2023	376d	180 days	ME resident >180d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Vermont State AGAug 15 · first

Indiana State AGAug 15 · first

Maine State AG+8d · this page

New Hampshire State AG+9d

Massachusetts State AG+13d

Pattern: first filing Aug 15 (VT), last Aug 28 (MA) — a 13-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/112871e6-3caf-412f-9441-5b2df08e2a2d.shtml
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 23, 2023
Raw hash: 0ff95a954492385508f308d4236940b64c14cf44ff52dca3ed333442bea4682f

Linked disclosures

Ransomware claims (1)

Regulatory filings (4) · sorted by filing gap

Reporting entityContinental AG

Victim entityContinental AG

Incidentdiscovered Aug 4, 2022

Stated responseSent written notification to affected consumers

ComplianceME AG >90d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov