MalwareManufacturingManufacturingRansomwareCapture Stored DataData ExfiltratedData PublishedRansom DemandedCustomer Data InvolvedMulti-Stage ChainIdentity (basic)Government IDMediumContained

Wabtec Corporation

bd_47d232164f93649f · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jun 26, 2022

Filed

Dec 30, 2022

To disclose

27 weeks

Affected

3state residents only

Linked

8 records

Confidence

66%

Wabtec Corporation reported a ransomware incident affecting 3 New Hampshire residents. Malware was introduced as early as March 15, 2022, with discovery on June 26, 2022. Attackers exfiltrated and published data including names and SSNs. Wabtec engaged forensic investigators, notified the FBI, and offered 24 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Leak gap clock⏱ Leak >90d27 weeks discovery → filing

Incident timeline

undetected · 103 days

discovery → filing · 27 weeks / 187 days

Mar 15, 2022

Begins

Jun 26, 2022

Discovered

Nov 23, 2022

Scope determined

Dec 30, 2022

Filed

This filing is one of 8 records about the same incident.View merged incident

A leak claim by lockbit_3 about this victim was first seen 134 days before this filing.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Sitelockbit_3bd_f415bb095f594df02022-08-18 · +134dCandidate

Regulatory filings (6) · sorted by filing gap

Indiana State AGbd_27cc78988cc3447f2022-12-30Candidate
Montana State AGbd_32b50f63129f43892022-12-30Verified
Maine State AGbd_5d570096087bd9d42022-12-30Verified
Massachusetts State AGbd_e328767b0ce8a4df2022-12-30Verified

Show 2 more filings ↓up to 370d gap

Illinois State AGbd_5c8d553efe1c93cd2024-01-01 · +367dVerified
California State AGbd_609e558e001a5da52024-01-04 · +370dVerified

Name: Wabtec Corporation
norm: wabtec
Domain: wabteccorp.com

Name: Wabtec Corporation
norm: wabtec
Domain: wabteccorp.com
Industry: Manufacturingnaics map

Discovered: Jun 26, 2022
Breach occurred: Mar 15, 2022
Undetected for: 103 daysoccurrence → discovery
Materiality determined: Nov 23, 2022
Notification sent: Dec 30, 2022
Affected individuals: 3state-resident count only
Data types: Identity (basic)Government ID
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 ChannelT1074 Data Staged
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Department of JusticeNotified the Federal Bureau of Investigation

During the incident: Notified the Federal Bureau of Investigation
Initiated incident response protocols
Began containment efforts
Launched an investigation with the assistance of leading cybersecurity firms
Began downloading the posted data for review
Sent data to a third-party data review firm to identify the individuals and the types of personal information impacted
Provided potentially affected individuals with guidance on how to protect against identity theft and fraud
Offered complimentary credit monitoring and identity restoration services for a period of twenty-four (24) months through Equifax
Changes made: Implementing additional procedural safeguards
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 27 weeks(187 days from discovery to filing)
Compliance flags: Leak >90d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 7 filings · 7 states

View merged incident ↗

Indiana State AGDec 30 · first

Montana State AGDec 30 · first

Maine State AGDec 30 · first

Massachusetts State AGDec 30 · first

New Hampshire State AGDec 30 · first · this page

Illinois State AG+367d

California State AG+370d

Pattern: first filing Dec 30 (IN), last Jan 4 (CA) — a 370-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/wabtec-corporation-20221230.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 30, 2022
Raw hash: ca5475530301a74b1f3b599a58dd66edd3b846f6556193a4b75b3f499a8df3c3

Linked disclosures

Ransomware claims (1)

Regulatory filings (6) · sorted by filing gap

Reporting entityWabtec Corporation

Victim entityWabtec Corporation

Incidentdiscovered Jun 26, 2022

Stated responseNotified the Federal Bureau of Investigation

ComplianceLeak >90d

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov