HackingRetail & ConsumerRetailStolen CredentialsCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDHighContained

SAPP BROS., INC.

bd_38355d5bb692b8b4 · schema v1 · pii pii-v1

Severity

High

Discovered

Aug 25, 2025

Filed

Dec 11, 2025

To disclose

15 weeks

Affected · nationwide

16,2921,741 in this filing

Confidence

66%

Full breach record for SAPP BROS., INC. →3 incidents on file

Sapp Bros., Inc. notified the Iowa AG of a cybersecurity incident on August 25, 2025, involving PII of approximately 16,292 individuals (including 1,741 Iowa residents). Accessed data included names, demographics, SSNs, and driver's license numbers. Sapp Bros engaged forensic experts, secured the network, disabled accounts, reset passwords, and enhanced MFA. Notification letters were mailed on December 10, 2025, offering 12 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Iowa clock✓ IA AG ≤5 bday15 weeks discovery → filing

⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Incident timeline

discovery → filing · 15 weeks / 108 days

Aug 25, 2025

Begins

Aug 25, 2025

Discovered

Dec 11, 2025

Filed

vs. sector median

+8 wks slower

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed16,292 affectedView incident

Name: Baird Holm LLP
norm: baird holm
Domain: sappbros.net

Name: SAPP BROS., INC.
norm: sapp bros
Domain: sappbros.net
Industry: Retail & Consumerllm

Discovered: Aug 25, 2025
Breach occurred: Aug 25, 2025
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Dec 10, 2025
Affected individuals: 16,292state + nationwide
Data types: Identity (basic)Government ID
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Notified Iowa Attorney General
Initial access: valid_credentials

During the incident: Hired a cyber expert to investigate how the attack occurred
Secured the network
Engaged a data expert to conduct a programmatic and manual review
Disabling the affected accounts
Forcing a password reset
Revoking administrator privileges for service accounts
Installing enhanced threat detection software on certain servers
Enhancing our multi-factor authentication requirements
Changes made: Working to implement additional technologies designed to prevent similar attacks including more extensive logging and real-time reporting
Exploring options for further hardening authentication standards
Offering identity theft protection services through IDX
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 15 weeks(108 days from discovery to filing)
Compliance flags: IA AG ≤5 bday
Discovery-date grounding: occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.iowaattorneygeneral.gov/media/cms/12112025_Sapp_Bros_5B03CB4A8049B.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 11, 2025
Raw hash: 96a3d4074a3c6cebe600be832862827e83e27af92aa25bec550ee45e020dddc2

Reporting entityBaird Holm LLP

Victim entitySAPP BROS., INC.

Incidentdiscovered Aug 25, 2025

Stated responseHired a cyber expert to investigate how the attack occurred

ComplianceIA AG ≤5 bday

Extraction provenanceno artifact recorded

Source provenancewww.iowaattorneygeneral.gov