SCANSOURCE, INC.
bd_4fc6c8360fd9d1a1 · schema v1 · pii pii-v1
Full breach record for SCANSOURCE, INC. →Press / market disclosure — not a breach-notification filing
A media or market posting that confirms an incident but carries no breach-notification fields, so compliance clocks aren't assessable. The summary below is extracted from the coverage — verify against the source.
ScanSource says ransomware attack behind multi-day outages. ScanSource: ScanSource, a US-based technology services provider, was the victim of a ransomware attack that affected some of its systems, business operations, and customer portals. The attack began on May 14, 2023, and resulted in delays in service delivery to customers in North America and Brazil. The company has activated its incident response plan and notified the relevant authorities. Cybersecurity experts have been engaged to help minimize operational disruptions caused by the incident. It is not yet known which ransomware operation is behind the attack or whether any data has been stolen. Linked ransomware group: cactus.
J jump to incidentP pin to compareR raw source
Incident timeline — mostly unverified
? — ?
Breach window unknown
May 14, 2023
Press report
—
Corroborated · see linked filings
Compliance clocks stay unassessable until a regulatory filing lands. Dashed segments fill in automatically when corroboration arrives.
Attack → press
—
Compliance clock
Not assessable
Linked disclosures
Why this link?Ransomware claims (1)
- Leak Sitecactusbd_6a943a8292a9b35d2023-07-20 · +67dVerified by operator
Regulatory filings (1) · sorted by filing gap
- SEC 8-Kbd_94e32d5ef83030c42023-08-22 · +100dCandidate
Filing propagation · 2 filings
View merged incident ↗Pattern: first filing May 14, last Aug 22 — a 100-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?
Evidence ladder
Attacker assertion only. Establishes: claim date, group, alleged victim.
Unlocks: incident narrative, operational impact. Still no compliance clock.
Unlocks: discovery date, data types, affected count, compliance clock.
Unlocks: materiality, stated response, full audit trail. Ceiling removed.
Source ceiling
- incident type + narrative only (may be machine-translated)
- discovery date
- materiality
- affected count
- data types
- compliance clock
The ✕ fields stay blank until a regulatory filing or victim disclosure lands.
cactus
According to ransomware.live, The CACTUS ransomware is said to have emerged around March 2023. The group became known for exploiting vulnerabilities to gain initial access and maintain a presence within the organization's infrastructure. There is little known information about the ransomware group, except that it emerged on the mentioned date and, following encryption, a text file named 'cAcTuS.readme.txt' would be created. Additionally, encrypted files were altered to the '.cts1' extension, and data exfiltration and victim extortion were conducted through the use of the service known as Tox. Source: https://github.com/crocodyli/ThreatActors-TTPs