HackingManufacturingManufacturingStolen CredentialsCustomer Data InvolvedIdentity (basic)CredentialsMediumContained

Century Aluminum Company

bd_33b2733f383aac44 · schema v1 · pii pii-v1

Severity

Medium

Discovered

—

Filed

Nov 22, 2022

To disclose

—

Affected

2,916state residents only

Linked

3 filings

Confidence

66%

Full breach record for Century Aluminum Company →

Century Aluminum Company notified individuals of a data breach where an unauthorized third party accessed the network between Jan 28 and Feb 16, 2022. The incident involved names and credentials. The company engaged forensic investigators and offered 12 months of identity theft protection. One Rhode Island resident was identified.

J jump to incidentP pin to compareR raw source

South Carolina clock✓ SC CRA notice due

⚠ no discovery dateNo discovery date was extracted, so no notification clock can be evaluated.

Incident timeline

Jan 28, 2022

Begins

Nov 22, 2022

Filed

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Montana State AGbd_422317281d5999262022-11-22Verified
Indiana State AGbd_8afa96c4b1c2356c2022-11-17 · +5dVerified

Name: Century Aluminum Company
norm: century aluminum

Name: Century Aluminum Company
norm: century aluminum
Industry: Manufacturingllm

Discovered: —
Breach occurred: Jan 28, 2022 – Feb 16, 2022
Materiality determined: —
Notification sent: Nov 17, 2022
Affected individuals: 2,916state-resident count only
Data types: Identity (basic)Credentials
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Initial access: valid_credentials

During the incident: Engaged a leading computer forensics firm to further examine our network and confirm the security of our systems
Offering identity theft protection services through IDX
Implementing additional data security processes, new security software, and other technical controls
Changes made: Implementing additional data security processes
Implementing new security software
Implementing other technical controls
Source: Quoted from the filing itself, not independently verified.

Compliance flags: SC CRA notice due
Discovery-date grounding: no discovery dateNo discovery date was extracted, so no notification clock can be evaluated.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Indiana State AGNov 17 · first

Montana State AG+5d

South Carolina State AG+5d · this page

Pattern: first filing Nov 17 (IN), last Nov 22 (SC) — a 5-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2022/CenturyAluminumCompany.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 22, 2022
Raw hash: bc8294dbf6965cd2130f57059011c61f2b3963012cbb8d4a7c6ac2fad1d0edab

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityCentury Aluminum Company

Victim entityCentury Aluminum Company

IncidentUnauthorized Access

Stated responseEngaged a leading computer forensics firm to further examine our network and confirm the security of our systems

ComplianceSC CRA notice due

Extraction provenanceno artifact recorded

Source provenanceconsumer.sc.gov