HackingProfessional ServicesProfessional ServicesStolen CredentialsTargetedIdentity (basic)Government IDHealth (basic)MediumContained

Alan Ritchey Inc.

bd_35a328c1e01c50b7 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Feb 6, 2024

Filed

Apr 15, 2024

To disclose

10 weeks

Affected

1state residents only

Linked

4 records

Confidence

65%

Full breach record for Alan Ritchey Inc. →

Alan Ritchey, Inc. notified Montana residents of a data breach occurring on Feb 6, 2024. An unauthorized user accessed the company server, exposing PII including SSNs, driver's licenses, and drug test results. The company terminated access, notified law enforcement, engaged forensic vendors, and offered 12 months of identity theft protection.

J jump to incidentP pin to compareR raw source

Leak gap clock⏱ Leak >30d10 weeks discovery → filing

⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Incident timeline

discovery → filing · 10 weeks / 69 days

Feb 6, 2024

Begins

Feb 6, 2024

Discovered

Apr 15, 2024

Filed

vs. sector median

9 wks faster

This filing is one of 4 records about the same incident.View merged incident

A leak claim by black_basta about this victim was first seen 46 days before this filing.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Siteblack_bastabd_2c2724f29fca962c2024-02-06 · +69dVerified by operator

Regulatory filings (2) · sorted by filing gap

Indiana State AGbd_eab065fa858454322024-04-12 · +3dVerified by operator
Massachusetts State AGbd_b3e8716423b4c1952024-04-04 · +11dVerified by operator

Name: Alan Ritchey Inc.
norm: alan ritchey
Domain: alanritchey.com

Name: Alan Ritchey Inc.
norm: alan ritchey
Domain: alanritchey.com
Industry: Professional Servicesllm

Discovered: Feb 6, 2024
Breach occurred: Feb 6, 2024
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 1state-resident count only
Data types: Identity (basic)Government IDHealth (basic)
Data elements: Social Security numberDate of birth
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Initial access: valid_credentials

During the incident: Terminated unauthorized user access
Notified law enforcement
Obtained a reputable third-party forensics vendor to analyze the scope of their unauthorized access
Offering identity theft protection services to all impacted adults through IDX
Changes made: Implement additional security controls to reduce the risk of a similar incident occurring again
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 10 weeks(69 days from discovery to filing)
Compliance flags: Leak >30d
Discovery-date grounding: occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Massachusetts State AGApr 4 · first

Indiana State AG+8d

Montana State AG+11d · this page

Pattern: first filing Apr 4 (MA), last Apr 15 (MT) — a 11-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-notification-letter-1282.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 15, 2024
Raw hash: 8c4a3fbdf1e16a467fbe0bfc1e8e8c0fda7b681076807bd88991b3ab9c7ac441

Linked disclosures

Ransomware claims (1)

Regulatory filings (2) · sorted by filing gap

Reporting entityAlan Ritchey Inc.

Victim entityAlan Ritchey Inc.

Incidentdiscovered Feb 6, 2024

Stated responseTerminated unauthorized user access

ComplianceLeak >30d

Extraction provenanceno artifact recorded

Source provenancedojmt.gov