MalwareRetail & ConsumerRetailRansomwareData EncryptedEmployee Data InvolvedIdentity (basic)Government IDMediumActive

EDW. C. Levy Co.

bd_36c8263e455e4be3 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Nov 1, 2023

Filed

Nov 13, 2025

To disclose

—

Affected

5state residents only

Confidence

68%

Full breach record for EDW. C. Levy Co. →3 incidents on file

Edw. C. Levy Co. notified the Maryland Attorney General of a ransomware attack discovered on November 1, 2023. The incident resulted in unauthorized access to employee files containing names and Social Security Numbers. Five Maryland residents were identified as potentially impacted. Levy reported the incident to federal law enforcement, engaged forensic specialists, and provided credit monitoring services to affected individuals.

J jump to incidentP pin to compareR raw source

Incident timeline

Nov 1, 2023

Discovered

Nov 13, 2025

Filed

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed5 affectedView incident

Name: Cipriani
norm: cipriani
Domain: cipriani.com

Name: EDW. C. Levy Co.
norm: edw c levy
Industry: Retail & Consumerllm

Discovered: Nov 1, 2023
Materiality determined: —
Notification sent: Jan 16, 2025
Affected individuals: 5state-resident count only
Data types: Government IDIdentity (basic)
Data elements: Social Security number
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for Impact
Threat actor: ExternalFinancial
Initial access: phishing_link

During the incident: Began working with its I.T. team and third-party forensic specialists to investigate the full nature and scope of the incident
Reported this incident to federal law enforcement
Provided notice to potentially impacted employees on December 27, 2023
Performed a comprehensive review of the contents of the email account
Provided notice to individuals whose personal information was contained therein accordingly
Undertook a comprehensive and time-intensive process to identify the information that may have been contained within the potentially impacted files
Undertook a time-consuming, manual review of its internal records in order to locate address information for those potentially impacted
Provided written notice of this incident to the potentially impacted Maryland residents
Offer of complimentary credit monitoring and identity protection services for twelve (12) months
Changes made: Offer of complimentary credit monitoring and identity protection services for twelve (12) months
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.maryland.gov/resources-info/SBN%20Documents/2025/ITU-376207.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 13, 2025
Raw hash: f5a5c3a280440e48f64eb4e4e7f4954502fae26c4514948f4e475ee288e3a036

Reporting entityCipriani

Victim entityEDW. C. Levy Co.

Incidentdiscovered Nov 1, 2023

Stated responseBegan working with its I.T. team and third-party forensic specialists to investigate the full nature and scope of the incident

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.maryland.gov