Social EngineeringRetail & ConsumerRetailPhishingStolen CredentialsCustomer Data InvolvedIdentity (basic)Government IDMediumContained

Liberty Lock and Security

bd_34e881d5c28ccfdc · schema v1 · pii pii-v1

Severity

Medium

Discovered

Dec 19, 2024

Filed

Feb 21, 2025

To disclose

9 weeks

Affected

2state residents only

Confidence

67%

Full breach record for Liberty Lock and Security →

Liberty Lock and Security notified Maryland AG of a data incident discovered Dec 19, 2024, where an email account was compromised. The breach exposed names, addresses, SSNs, and driver's license info for 2 Maryland residents. LLS engaged forensic investigators, secured the account, changed credentials, and offered 12 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Maryland clock⏱ MD AG >30d9 weeks discovery → filing

Incident timeline

discovery → filing · 9 weeks / 64 days

Dec 19, 2024

Discovered

Feb 21, 2025

Filed

vs. sector median

+2 wks slower

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed2 affectedView incident

Name: Liberty Lock and Security
norm: liberty lock and security

Name: Liberty Lock and Security
norm: liberty lock and security
Industry: Retail & Consumerllm

Discovered: Dec 19, 2024
Materiality determined: —
Notification sent: Feb 21, 2025
Affected individuals: 2state-resident count only
Data types: Identity (basic)Government ID
Data elements: Social Security number
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Notified Maryland Office of the Attorney General
Initial access: phishing_link

During the incident: Engaged a specialized third-party cybersecurity firm to conduct a comprehensive investigation
Secured the compromised email account
Changed all user credentials
Enhanced the security measures
Offered 12 months of complimentary credit monitoring and identity theft restoration services through IDX
Changes made: Enhanced the security measures
Changed all user credentials
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 9 weeks(64 days from discovery to filing)
Compliance flags: MD AG >30d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.maryland.gov/resources-info/SBN%20Documents/2025/ITU-376399.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 21, 2025
Raw hash: 86d76d6ddd75fbf05fe7d4f5ae2e49e2e7f9c7a55df6ab1120320000296f1771

Reporting entityLiberty Lock and Security

Victim entityLiberty Lock and Security

Incidentdiscovered Dec 19, 2024

Stated responseEngaged a specialized third-party cybersecurity firm to conduct a comprehensive investigation

ComplianceMD AG >30d

Extraction provenanceno artifact recorded

Source provenanceoag.maryland.gov