MalwareRetail & ConsumerManufacturingRetailRansomwareCapture Stored DataData ExfiltratedData EncryptedCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDFinancial accountEmploymentMediumContained

A. Duda & Sons Inc.

bd_4f72abedbcfb0cbb · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jul 9, 2022

Filed

Aug 3, 2022

To disclose

25 days

Affected

1state residents only

Linked

6 filings

Confidence

65%

Full breach record for A. Duda & Sons Inc. →

A. Duda & Sons, Inc. notified Montana residents of a June-July 2022 ransomware attack. Attackers exploited IT systems, encrypted networks, and exfiltrated PII including SSNs, payroll data, and financial info. DUDA reported to law enforcement, engaged consultants, and offered 24 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 38 days

discovery → filing · 25 days

Jun 1, 2022

Begins

Jul 9, 2022

Discovered

Aug 3, 2022

Filed

vs. sector median

4 wks faster

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Sitealphvbd_a8a3e06868deccd62022-07-14 · +20dVerified by operator

Regulatory filings (4) · sorted by filing gap

Oregon State AGbd_1a43af04930a557d2022-08-03Candidate
Indiana State AGbd_254bb0835280f5952022-08-03Verified
South Carolina State AGbd_6eb70b8dbaff7c052022-08-03Verified
California State AGbd_c6a3c369757bfe9c2022-08-03Verified

Name: A. Duda & Sons Inc.
norm: a duda sons
Domain: duda.com

Name: A. Duda & Sons Inc.
norm: a duda sons
Domain: duda.com
Industry: Retail & ConsumerllmManufacturingllm

Discovered: Jul 9, 2022
Breach occurred: Jun 1, 2022 – Jul 9, 2022
Undetected for: 38 daysoccurrence → discovery
Materiality determined: —
Notification sent: Aug 3, 2022
Affected individuals: 1state-resident count only
Data types: Identity (basic)Government IDFinancial accountEmployment
Data elements: Social Security numberDate of birth
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 ChannelT1190 Exploit Public-Facing Application
Threat actor: ExternalFinancial
Regulator citations: Reported the incident to law enforcement
Initial access: exploit_public_facing

During the incident: DUDA reported the incident to law enforcement
DUDA is cooperating with law enforcement investigating the attack
DUDA is working with outside consultants to strengthen our information security systems
Offering certain credit monitoring services at no cost
Changes made: Restoring functionality and security of data systems
Strengthening information security systems to reduce the risk of a similar attack in the future
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 25 days(25 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Oregon State AGAug 3 · first

Indiana State AGAug 3 · first

South Carolina State AGAug 3 · first

California State AGAug 3 · first

Montana State AGAug 3 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-Notification-Letter-463.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 3, 2022
Raw hash: 5cd4d7a85e2bf5a5a526341b155ad4e10815c74d32945a764bca9aa97cc0d0db

Linked disclosures

Ransomware claims (1)

Regulatory filings (4) · sorted by filing gap

Reporting entityA. Duda & Sons Inc.

Victim entityA. Duda & Sons Inc.

Incidentdiscovered Jul 9, 2022

Stated responseDUDA reported the incident to law enforcement

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov