HackingManufacturingManufacturingVulnerability ExploitData ExfiltratedSupply Chain (3P Vendor)Customer Data InvolvedGovernment IDIdentity (basic)MediumContained

Fluke Process Instruments

bd_4b1eda5824917eb3 · schema v1 · pii pii-v2

Severity

Medium

Discovered

Sep 29, 2025

Filed

May 15, 2026

To disclose

33 weeks

Affected

49state residents only

Linked

10 filings

Confidence

68%

Full breach record for Fluke Process Instruments →2 incidents on file

Fluke Corporation notified Montana regulators of a data breach involving a third-party application vulnerability. A criminal actor exploited the vulnerability, gaining unauthorized access to a segment of Fluke's network from August 10, 2025, to October 7, 2025. The incident exposed Social Security Numbers and dates of birth. Fluke engaged forensic investigators, ejected the actor, patched the vulnerability, and offered 24 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 50 days

discovery → filing · 33 weeks / 228 days

Aug 10, 2025

Begins

Sep 29, 2025

Discovered

May 15, 2026

Filed

vs. sector median

+22 wks slower

This filing is one of 10 about the same incident.View merged incident

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Siteshinyhuntersbd_72002bb817afd9dc2026-07-01 · +47dVerified by operator

Regulatory filings (8) · sorted by filing gap

Nebraska State AGbd_3be9bd69158105022026-05-15Verified
Texas State AGbd_c577591a34e2a9f72026-05-15Verified by operator
Massachusetts State AGbd_f303f7e614c53e9c2026-05-15Verified by operator
Indiana State AGbd_fe9ebc44bee9b4ce2026-05-15Verified by operator

Show 4 more filings ↓up to 56d gap

Washington State AGbd_3fd89a2eda6622b92026-05-14 · +1dVerified by operator
Vermont State AGbd_85f3ddcbbdc8bd092026-05-13 · +2dVerified by operator
New Hampshire State AGbd_8c34ff6ba42b5c912026-05-18 · +3dVerified by operator
Texas State AGbd_ce33113ba7b92d6d2026-07-10 · +56dCandidate

Name: Fluke Process Instruments
norm: fluke process instruments
Domain: flukeprocessinstruments.com

Name: Fluke Process Instruments
norm: fluke process instruments
Domain: flukeprocessinstruments.com
Industry: Manufacturingllm

Discovered: Sep 29, 2025
Breach occurred: Aug 10, 2025 – Oct 7, 2025
Undetected for: 50 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 49state-resident count only
Data types: Government IDIdentity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1078 Valid Accounts
Threat actor: ExternalFinancial
Initial access: exploit_public_facing

During the incident: Launched a thorough investigation with the support of a leading cybersecurity firm
Engaged a leading data forensics firm to analyze the contents of the data that may have been accessed without authorization
Making identity theft prevention and mitigation services, including credit monitoring, available through Epiq for a period of twenty-four (24) months at no cost to you
Ejecting the criminal actor from our network
Patching the vulnerability promptly after the third-party made a patch available
Resetting administrative passwords, removing malicious accounts, and ensuring no credentials were stolen or compromised
Deploying an endpoint detection and response tool with host-based detection and response capabilities on the host side, and a firewall management platform for network control and situational awareness
Changes made: Patching the vulnerability promptly after the third-party made a patch available
Resetting administrative passwords, removing malicious accounts, and ensuring no credentials were stolen or compromised
Deploying an endpoint detection and response tool with host-based detection and response capabilities on the host side, and a firewall management platform for network control and situational awareness
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 33 weeks(228 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 9 filings · 8 states

View merged incident ↗

Vermont State AGMay 13 · first

Washington State AG+1d

Nebraska State AG+2d

Texas State AG+2d

Massachusetts State AG+2d

Indiana State AG+2d

Montana State AG+2d · this page

New Hampshire State AG+5d

Texas State AG+58d

Pattern: first filing May 13 (VT), last Jul 10 (TX) — a 58-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/2026/09/Consumer-notification-letter-18.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 15, 2026
Raw hash: b0f83998882509fc831ab2050882cab341df603dc4c918f8dd3e415971d4fff3

Linked disclosures

Ransomware claims (1)

Regulatory filings (8) · sorted by filing gap

Reporting entityFluke Process Instruments

Victim entityFluke Process Instruments

Incidentdiscovered Sep 29, 2025

Stated responseLaunched a thorough investigation with the support of a leading cybersecurity firm

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov