MalwareRansomwareRansom DemandedEmployee Data InvolvedCustomer Data InvolvedIdentity (basic)Government IDHealth (basic)Financial accountMediumContained

AireSpring, Inc.

bd_2782ac2cd9a65b79 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Apr 7, 2021

Filed

Jun 10, 2021

To disclose

9 weeks

Affected

Not disclosed

Linked

5 filings

Confidence

64%

Full breach record for AireSpring, Inc. →

AireSpring, Inc. experienced a ransomware attack on April 7, 2021, where an unauthorized party installed ransomware on company systems. The attacker sought a ransom payment. Affected data included names, addresses, Social Security numbers, driver's license numbers, passport numbers, health insurance information, and credit/debit card details for employees and customers. AireSpring took systems offline, engaged forensic experts, notified law enforcement, and offered credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 9 weeks / 64 days

Apr 7, 2021

Begins

Apr 7, 2021

Discovered

Jun 10, 2021

Filed

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Montana State AGbd_1ff94ac48512112f2021-06-10Candidate
Maine State AGbd_3df0cbbadafe99fb2021-06-10Verified
Massachusetts State AGbd_017ea993261584a32021-06-11 · +1dVerified
New Hampshire State AGbd_e7541606e0e31d792021-06-14 · +4dVerified

Name: AireSpring, Inc.
norm: airespring

Name: AireSpring, Inc.
norm: airespring

Discovered: Apr 7, 2021
Breach occurred: Apr 7, 2021
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jun 10, 2021
Affected individuals: Not disclosed
Data types: Identity (basic)Government IDHealth (basic)Financial account
Data elements: Social Security number
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for Impact
Threat actor: ExternalFinancial
Regulator citations: Promptly informed federal law enforcement

During the incident: Took the affected systems offline
Retained forensic experts who launched an investigation
Promptly informed federal law enforcement
Offering identity theft protection and credit monitoring services through IDX
Changes made: Taking several steps to further strengthen and enhance information security controls and procedures
Working with independent third party security consultants
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 9 weeks(64 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Montana State AGJun 10 · first

Maine State AGJun 10 · first

California State AGJun 10 · first · this page

Massachusetts State AG+1d

New Hampshire State AG+4d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-541755
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 10, 2021
Raw hash: ebe352a9513967da9b1d454fc2651078863caf85c8de41f86c079a1ad68daf88

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityAireSpring, Inc.

Victim entityAireSpring, Inc.

Incidentdiscovered Apr 7, 2021

Stated responseTook the affected systems offline

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov