MalwareRetail & ConsumerRetailRansomwareData ExfiltratedRansom DemandedTargetedIdentity (basic)Government IDHighContained

Sound Window & Door Inc

bd_282379617134571d · schema v1 · pii pii-v1

Severity

High

Discovered

Mar 31, 2025

Filed

Jan 23, 2026

To disclose

43 weeks

Affected

3,024state residents only

Linked

4 filings

Confidence

71%

Full breach record for Sound Window & Door Inc →

Sound Window & Door, Inc. reported a ransomware incident affecting 3,024 Washington residents. Unauthorized access occurred March 29-31, 2025, discovered March 31, 2025. Data exposed included names, SSNs, DOBs, and driver's licenses. Notices sent January 23, 2026. Credit monitoring offered.

J jump to incidentP pin to compareR raw source

Washington clock✗ WA AG >90d43 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 2 days

discovery → filing · 43 weeks / 298 days

Mar 29, 2025

Begins

Mar 31, 2025

Discovered

Jan 23, 2026

Filed

vs. sector median

+33 wks slower

This filing is one of 4 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Massachusetts State AGbd_736fdd0a513796512026-01-23Verified
Indiana State AGbd_c464180e19b5a8602026-01-23Verified
Indiana State AGbd_f8e43ca42b663e4b2026-01-23Verified

Name: Sound Window & Door Inc
norm: sound window door

Name: Sound Window & Door Inc
norm: sound window door
Industry: Retail & Consumerllm

Discovered: Mar 31, 2025
Breach occurred: Mar 29, 2025 – Mar 31, 2025
Undetected for: 2 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jan 23, 2026
Affected individuals: 3,024state-resident count only
Data types: Identity (basic)Government ID
Data elements: NameSocial Security numberDriver's licence numberDate of birth
WA-stated cause: Cyberattack
WA-stated duration: lifecycle 1-99dexposure 1-99d
WA-stated discovery: Found while ongoingContained same day
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: providing written notice of this incident to relevant state regulators, as necessary
Initial access: valid_credentials

During the incident: Launched an investigation to determine the nature and scope of the activity
Undertook a detailed review of all the files potentially impacted
Working to implement additional safeguards
Providing access to credit monitoring services one (1) year, through CyberScout, a TransUnion company
Providing impacted individuals with guidance on how to better protect against identity theft and fraud
Providing written notice of this incident to relevant state regulators
Providing written notice to the three major credit reporting agencies, Equifax, Experian, and TransUnion
Changes made: Enhanced its existing security protocols
Continues to evaluate its policies and procedures related to data privacy and security
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 43 weeks(298 days from discovery to filing)
Compliance flags: WA AG >90d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 3 states

View merged incident ↗

Massachusetts State AGJan 23 · first

Indiana State AGJan 23 · first

Washington State AGJan 23 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA36335.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 23, 2026
Raw hash: d0d6c6f1cb155069e0d3369c21438f9cca9bc0e1fc4ce22ca2166576115e2295

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entitySound Window & Door Inc

Victim entitySound Window & Door Inc

Incidentdiscovered Mar 31, 2025

Stated responseLaunched an investigation to determine the nature and scope of the activity

ComplianceWA AG >90d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com