MalwareManufacturingRetail & ConsumerManufacturingRansomwareRansom DemandedEmployee Data InvolvedData ExfiltratedGovernment IDHighContained

NISSAN NORTH AMERICA, INC.

bd_3b0533440a89abda · schema v1 · pii pii-v1

Severity

High

Discovered

Feb 28, 2024

Filed

May 14, 2024

To disclose

11 weeks

Affected · nationwide

53,0389 in this filing

Linked

8 filings

Confidence

66%

Full breach record for NISSAN NORTH AMERICA, INC. →5 incidents on file

On November 7, 2023, Nissan North America, Inc. (NNA) experienced a ransomware attack where a threat actor breached its external VPN, shut down systems, and demanded a ransom. The investigation confirmed on February 28, 2024, that personal information of 53,038 individuals, primarily current and former employees, was accessed. The compromised data included Social Security numbers. NNA began notifying affected individuals on May 15, 2024, and offered 24 months of identity theft protection services through Experian.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Feb 28, 2024 → Filed with AG May 14, 202476d ⏱ ME AG >30d11 weeks discovery → filing

Incident timeline

undetected · 113 days

discovery → filing · 11 weeks / 76 days

Nov 7, 2023

Begins

Feb 28, 2024

Discovered

May 14, 2024

Filed

This filing is one of 8 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (7) · sorted by filing gap

Montana State AGbd_019206705c1b19572024-05-14Candidate
California State AGbd_a270e89ba8e110732024-05-14Verified
New Hampshire State AGbd_a59484e9435b26e22024-05-14Verified
Massachusetts State AGbd_dbd710c9748f38262024-05-14Verified

Show 3 more filings ↓up to 13d gap

Indiana State AGbd_a4b8e4f0871ced962024-05-15 · +1dVerified
Vermont State AGbd_f9f622a7f03220442024-05-15 · +1dVerified
Illinois State AGbd_67cb177dddd4906d2024-05-01 · +13dVerified

Name: NISSAN NORTH AMERICA, INC.
norm: nissan north america

Name: NISSAN NORTH AMERICA, INC.
norm: nissan north america
Industry: ManufacturingllmRetail & Consumerllm

Discovered: Feb 28, 2024
Breach occurred: Nov 7, 2023
Undetected for: 113 daysoccurrence → discovery
Materiality determined: —
Notification sent: May 15, 2024
Affected individuals: 53,038state + nationwide
Data types: Government ID
Data elements: Social Security number
Attack vector: Ransomware
Threat actor: ExternalFinancial

During the incident: Investigated, contained, and successfully terminated the threat
Notified law enforcement of the data incident
Notified all current employees of the incident
Providing affected residents with access to Experian’s IdentityWorks services for 24 months
Providing proactive fraud assistance
Changes made: Enterprise-wide password reset
Implementation of Carbon Black monitoring on all compatible systems
Vulnerability scans
Reviewing its security processes and procedures for additional recommended remediation and protection efforts
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 11 weeks(76 days from discovery to filing)
Compliance flags: ME AG >30d · 76dME resident >60d · 77d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Feb 28, 2024
→ Filed with AG: May 14, 2024
76d 30 days (soft) ME AG >30d
Maine
Discovered: Feb 28, 2024
→ Notified: May 15, 2024
77d 60 days (analyst band; statutory cap is 30 days) ME resident >60d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Feb 28, 2024 → Filed with AG: May 14, 2024	76d	30 days (soft)	ME AG >30d
Maine	Discovered: Feb 28, 2024 → Notified: May 15, 2024	77d	60 days (analyst band; statutory cap is 30 days)	ME resident >60d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 8 filings · 8 states

View merged incident ↗

Illinois State AGMay 1 · first

Montana State AG+13d

California State AG+13d

New Hampshire State AG+13d

Massachusetts State AG+13d

Maine State AG+13d · this page

Indiana State AG+14d

Vermont State AG+14d

Pattern: first filing May 1 (IL), last May 15 (VT) — a 14-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/d34f3290-0126-421f-9d69-5ccd31652641.shtml
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 14, 2024
Raw hash: 38aaf63f6bbc76bebf0135ab45876cf11449a4f337771d3ff43ce133c9e427d2

Linked disclosures

Regulatory filings (7) · sorted by filing gap

Reporting entityNISSAN NORTH AMERICA, INC.

Victim entityNISSAN NORTH AMERICA, INC.

Incidentdiscovered Feb 28, 2024

Stated responseInvestigated, contained, and successfully terminated the threat

ComplianceME AG >30d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov