MalwareRetail & ConsumerRetailRansomwareStolen CredentialsData ExfiltratedData EncryptedCustomer Data InvolvedEmployee Data InvolvedPIIIdentity (basic)EmploymentLowContained

Bath Fitter Distributing Inc.

bd_470885952a8d2980 · schema v1 · pii pii-v1

Severity

Low

Discovered

Dec 5, 2024

Filed

Apr 15, 2025

To disclose

19 weeks

Affected

49state residents only

Linked

5 filings

Confidence

65%

Full breach record for Bath Fitter Distributing Inc. →2 incidents on file

Bath Fitter Distributing Inc. reported a ransomware attack occurring Dec 4-5, 2024. An external actor impersonated IT support to gain network access, encrypt files, and potentially exfiltrate data. The incident was discovered on Dec 5, 2024. Personal information of 49 New Hampshire current and former employees was impacted. The company isolated the network, disabled remote access, built a new network, and offered credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 1 days

discovery → filing · 19 weeks / 131 days

Dec 4, 2024

Begins

Dec 5, 2024

Discovered

Mar 7, 2025

Scope determined

Apr 15, 2025

Filed

vs. sector median

+11 wks slower

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Indiana State AGbd_25a4eb9673b878852025-04-18 · +3dVerified
Maine State AGbd_fb709bb811158e6e2025-04-22 · +7dCandidate
Nebraska State AGbd_2e7b0e218cf7dbfd2025-04-23 · +8dVerified
Massachusetts State AGbd_f35ec7e382df7bfd2025-04-24 · +9dVerified

Name: Bath Fitter Distributing Inc.
norm: bath fitter distributing

Name: Bath Fitter Distributing Inc.
norm: bath fitter distributing
Industry: Retail & Consumerllm

Discovered: Dec 5, 2024
Breach occurred: Dec 4, 2024 – Dec 5, 2024
Undetected for: 1 dayoccurrence → discovery
Materiality determined: Mar 7, 2025
Notification sent: Apr 17, 2025
Affected individuals: 49state-resident count only
Data types: PIIIdentity (basic)Employment
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1078 Valid AccountsT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Filed Notice of Security Incident with New Hampshire Consumer Protection & Antitrust Bureau
Initial access: phishing_link

During the incident: Launched an investigation
Isolated the affected local area network
Disabled VPN services and remote access to our network
Built a new, separate network with limited access to our systems
Sent an email to all current employees providing interim notice
Made arrangements with CyEx for credit monitoring services
Changes made: Built a new, separate network with limited access to our systems
Enhancing security measures as necessary to reduce the chances of future incidents
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 19 weeks(131 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

New Hampshire State AGApr 15 · first · this page

Indiana State AG+3d

Maine State AG+7d

Nebraska State AG+8d

Massachusetts State AG+9d

Pattern: first filing Apr 15 (NH), last Apr 24 (MA) — a 9-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/bath-fitter-distributing-20250415.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 15, 2025
Raw hash: 83e75973dc2817b3a4483ea4bee9b3c72c849abac57c13b1805b9c9b6c61277b

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityBath Fitter Distributing Inc.

Victim entityBath Fitter Distributing Inc.

Incidentdiscovered Dec 5, 2024

Stated responseLaunched an investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov