HackingTransportation & LogisticsProfessional ServicesTransportationDelayed DiscoverySupply Chain (3P Vendor)Employee Data InvolvedCustomer Data InvolvedIdentity (basic)Government IDHighResolved

Livingston International

bd_2daf5bfec4c1e187 · schema v1 · pii pii-v1

Severity

High

Discovered

Feb 1, 2023

Filed

Apr 22, 2023

To disclose

11 weeks

Affected · nationwide

5,19911 in this filing

Linked

8 filings

Confidence

66%

Full breach record for Livingston International →2 incidents on file

Livingston International Inc. experienced a security incident on December 2, 2022, within a legacy third-party network environment, which was discovered to be a breach on December 7, 2022. The company confirmed that sensitive personal information was impacted on February 1, 2023. The breach affected 5,199 individuals, compromising names and Social Security numbers. Livingston decommissioned the affected environment, engaged a security firm, and offered 24 months of complimentary credit monitoring and identity restoration services to impacted individuals.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Feb 1, 2023 → Filed with AG Apr 22, 202380d ⏱ ME AG >30d11 weeks discovery → filing

Incident timeline

undetected · 61 days

discovery → filing · 11 weeks / 80 days

Dec 2, 2022

Begins

Feb 1, 2023

Discovered

Apr 22, 2023

Filed

This filing is one of 8 about the same incident.View merged incident

A leak claim by avoslocker about this victim predates this filing by 117 days.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (2)

Leak Siteblacksuitbd_2be963ef20c780662023-01-17 · +95dVerified
Leak Siteavoslockerbd_1557fc58497f90a92022-12-26 · +117dVerified by operator

Regulatory filings (5) · sorted by filing gap

Massachusetts State AGbd_f24e3ad00bd6c5ab2023-04-22Verified by operator
Vermont State AGbd_cea56cb7ecae36282023-04-21 · +1dVerified by operator
Montana State AGbd_d9a51af898979c772023-04-11 · +11dVerified by operator
Illinois State AGbd_0e2f93e80e4cda682023-01-01 · +111dVerified by operator

Show 1 more filing ↓up to 111d gap

Illinois State AGbd_1e110ed342d8061d2023-01-01 · +111dVerified by operator

Name: Livingston International
norm: livingston international
Domain: livingstonintl.com

Name: Livingston International
norm: livingston international
Domain: livingstonintl.com
Industry: Transportation & LogisticsllmProfessional Servicesllm

Discovered: Feb 1, 2023
Breach occurred: Dec 2, 2022
Undetected for: 61 daysoccurrence → discovery
Materiality determined: —
Notification sent: Apr 13, 2023
Affected individuals: 5,199state + nationwide
Data types: Identity (basic)Government ID
Data elements: Social Security number
Attack vector: Unauthorized Access
Threat actor: External

During the incident: Immediately took steps to contain and remediate the impact of the incident.
Engaged a security firm to conduct a forensics investigation.
Fully decommissioned the legacy third-party environment.
Informed all US employees of the incident by email.
Engaged a vendor to conduct a detailed review of the data that could have been compromised.
Notified the impacted Maine residents of the security incident by mail.
Changes made: Provided a complimentary 24-month subscription to credit monitoring and identity restoration services provided by Cyberscout (a TransUnion brand).
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 11 weeks(80 days from discovery to filing)
Compliance flags: ME AG >30d · 80dME resident >60d · 71dLeak >90d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Feb 1, 2023
→ Filed with AG: Apr 22, 2023
80d 30 days (soft) ME AG >30d
Maine
Discovered: Feb 1, 2023
→ Notified: Apr 13, 2023
71d 60 days (analyst band; statutory cap is 30 days) ME resident >60d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Feb 1, 2023 → Filed with AG: Apr 22, 2023	80d	30 days (soft)	ME AG >30d
Maine	Discovered: Feb 1, 2023 → Notified: Apr 13, 2023	71d	60 days (analyst band; statutory cap is 30 days)	ME resident >60d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 5 states

View merged incident ↗

Illinois State AGJan 1 · first

Montana State AG+100d

Vermont State AG+110d

Massachusetts State AG+111d

Maine State AG+111d · this page

Pattern: first filing Jan 1 (IL), last Apr 22 (ME) — a 111-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/32664882-0910-4fb4-93cb-fe0040e90528.shtml
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 22, 2023
Raw hash: fde10089be2959b3e2aa96f25553ebac5c3ceedb6eb91c079754d348ad8ef8d2

Linked disclosures

Ransomware claims (2)

Regulatory filings (5) · sorted by filing gap

Reporting entityLivingston International

Victim entityLivingston International

Incidentdiscovered Feb 1, 2023

Stated responseImmediately took steps to contain and remediate the impact of the incident.

ComplianceME AG >30d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov