HackingVulnerability ExploitZero-DaySupply Chain (3P Vendor)Data ExfiltratedIDENTITY_BASICCREDENTIALSLowContained
BISSELL, Inc
bd_45820182c3db882f · schema v1 · pii pii-v1
Full breach record for BISSELL, Inc →Bissell notified consumers of a data breach involving its third-party file transfer vendor, Fortra. Between Jan 28-31, 2023, attackers exploited a zero-day vulnerability in Fortra's GoAnywhere platform to access Bissell's files. Bissell determined on March 27, 2023, that consumer PII (names, addresses, emails, phone numbers) was involved. Bissell notified law enforcement, engaged in investigation, and offered one year of Experian IdentityWorks credit monitoring to affected individuals.
Vermont clock⏱ VT AG >14 bday24 days discovery → filing
⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
This filing is one of 4 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (3) · sorted by filing gap
- bd_0cba799bed55bffaNew Hampshire State AGfiled 2023-04-20Verified
- bd_4ee3cba7b773cc10Maine State AGfiled 2023-04-20Candidate
- bd_5c73077d258932bcMontana State AGfiled 2023-04-20Verified
Source provenance
- Source URL
- https://ago.vermont.gov/document/2023-04-20-bissell-data-breach-notice-consumers
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Apr 20, 2023
- Raw hash
- 9b96f15d35e285a4e372df1faf4181400f9e9d087cf9a151a915b203535c0275
Reporting entity
- Name
- BISSELL, Incnorm: bissell
Victim entity
- Name
- BISSELL, Incnorm: bissell
Incident
- Discovered
- Mar 27, 2023
- Materiality determined
- Mar 27, 2023
- Notification sent
- Apr 20, 2023
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_BASICCREDENTIALS
- Attack vector
- Third-Party / Supply Chain
- MITRE ATT&CK
- T1195 Supply Chain CompromiseT1190 Exploit Public-Facing Application
- Threat actor
- ExternalFinancial
- Regulator citations
- Notified law enforcement
- Third party
- via Fortra
- Initial access
- exploit_public_facing
Compliance
- Time to disclose
- 24 days(24 days from discovery to filing)
- Compliance flags
- VT AG >14 bday
- Discovery-date grounding
- unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.