HackingStolen CredentialsCustomer Data InvolvedIDENTITY_BASICPIILowContained
Sugar and Steel Corporation
bd_28baf0b22a3a3528 · schema v1 · pii pii-v1
Full breach record for Sugar and Steel Corporation →Sugar Steel Corporation experienced unauthorized access to two employee email accounts between December 8 and 22, 2020. An unknown actor accessed the accounts, potentially viewing or removing personal information including names and variable data. The company implemented multi-factor authentication, offered credit monitoring and identity theft restoration services, and notified state regulators.
California clockDiscovered Dec 22, 2020 → Notified Sep 17, 2021269d ✗ CA 60-day late38 weeks discovery → filing
⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
This filing is one of 2 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (1) · sorted by filing gap
- bd_07a35eb922454393Maine State AGfiled 2021-09-17Verified
Source provenance
- Source URL
- https://oag.ca.gov/ecrime/databreach/reports/sb24-545476
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Sep 17, 2021
- Raw hash
- d6e72151f7509f8a7652cf7e4dd819eef624aa2a1aba153291b2b6cbd8f70c4d
Reporting entity
- Name
- Sugar and Steel Corporationnorm: sugar and steel
- Domain
- sugarsteel.com
Victim entity
- Name
- Sugar and Steel Corporationnorm: sugar and steel
- Domain
- sugarsteel.com
Incident
- Discovered
- Dec 22, 2020
- Materiality determined
- —
- Notification sent
- Sep 17, 2021
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_BASICPII
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1078 Valid Accounts
- Threat actor
- External
- Regulator citations
- reported this event to certain state regulators
- Initial access
- valid_credentials
Compliance
- Time to disclose
- 38 weeks(269 days from discovery to filing)
- Compliance flags
- CA 60-day late · 269d
- Discovery-date grounding
- unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
- Clock breakdown
Statute Window Elapsed Threshold Status California Discovered: Dec 22, 2020→ Notified: Sep 17, 2021269d 60 days (analyst band, pre-2026 discoveries) CA 60-day late
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.