HackingProfessional ServicesProfessional ServicesStolen CredentialsData ExfiltratedIdentity (basic)Government IDMediumContained

Randall-Reilly

bd_3c3f1cd79d86ff41 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Apr 1, 2022

Filed

Jun 10, 2022

To disclose

10 weeks

Affected

58state residents only

Linked

5 filings

Confidence

66%

Full breach record for Randall-Reilly →

Randall-Reilly LLC notified Montana residents of a security incident where a security vendor made the company aware of data potentially accessible to third parties on April 1, 2022. The incident involved names, SSNs, and driver's license numbers of individuals seeking truck driving jobs. No misuse was indicated. Kroll provided one year of identity monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 10 weeks / 70 days

Apr 1, 2022

Discovered

Jun 10, 2022

Filed

vs. sector median

8 wks faster

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Indiana State AGbd_22fcb1553c6c224c2022-06-10Verified
Massachusetts State AGbd_44204ae0f24556062022-06-21 · +11dVerified
Maine State AGbd_58f44f5c0df6b8622022-06-21 · +11dVerified
Illinois State AGbd_2490ae76d5b681122022-01-01 · +160dCandidate

Name: Randall-Reilly
norm: randall reilly

Name: Randall-Reilly
norm: randall reilly
Industry: Professional Servicesllm

Discovered: Apr 1, 2022
Materiality determined: —
Notification sent: —
Affected individuals: 58state-resident count only
Data types: Identity (basic)Government ID
Data elements: Social Security number
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain Compromise
Initial access: supply_chain

During the incident: Investigated the situation with the help of additional outside experts
Terminated the accessibility of the data and contained the event
Secured the services of Kroll to provide identity monitoring at no cost to you for one year
Changes made: Taken steps to secure our environment
Focus on strengthening the cyber-resiliency of our company
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 10 weeks(70 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Illinois State AGJan 1 · first

Indiana State AG+160d

Montana State AG+160d · this page

Massachusetts State AG+171d

Maine State AG+171d

Pattern: first filing Jan 1 (IL), last Jun 21 (ME) — a 171-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-Notification-84.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 10, 2022
Raw hash: 0e49d709baba7747c783d3e78339250aa01ff08abf34d3bad8d30cbd7eaf6b05

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityRandall-Reilly

Victim entityRandall-Reilly

Incidentdiscovered Apr 1, 2022

Stated responseInvestigated the situation with the help of additional outside experts

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov