MalwareRetail & ConsumerRetailRansomwareCapture Stored DataData ExfiltratedData EncryptedCustomer Data InvolvedTargetedFinancial accountIdentity (basic)Government IDPHIHealth (basic)HighContained

Albertsons Companies, Inc.

bd_556f510ad121c832 · schema v1 · pii pii-v1

Severity

High

Discovered

Dec 23, 2022

Filed

Apr 20, 2023

To disclose

17 weeks

Affected

1,882state residents only

Linked

9 filings

Confidence

69%

Full breach record for Albertsons Companies, Inc. →6 incidents on file

Albertsons Companies, Inc. reported a ransomware incident in Washington affecting 1,882 residents. Unauthorized access occurred Dec 22-24, 2022, discovered Dec 23, 2022. Personal info (names) accessed. Notifications sent April 21, 2023. Forensic investigation and law enforcement notification occurred.

J jump to incidentP pin to compareR raw source

Washington clock✗ WA AG >90d17 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 1 days

discovery → filing · 17 weeks / 118 days

Dec 22, 2022

Begins

Dec 23, 2022

Discovered

Apr 20, 2023

Filed

vs. sector median

+9 wks slower

This filing is one of 9 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (8) · sorted by filing gap

California State AGbd_30bec6ca1499d08d2023-04-20Candidate
Oregon State AGbd_3be80bc4bbc052552023-04-21 · +1dVerified
Indiana State AGbd_457530dc2f4f9c8d2023-04-21 · +1dVerified
Massachusetts State AGbd_56855ad2862f61252023-04-21 · +1dVerified

Show 4 more filings ↓up to 7d gap

Montana State AGbd_6df88f1931ce90022023-04-21 · +1dVerified
Maine State AGbd_814c10e14c785e552023-04-21 · +1dVerified
New Hampshire State AGbd_dbc4df7b8cffb2d22023-04-21 · +1dVerified
Vermont State AGbd_c85a389e62bca4202023-04-13 · +7dVerified

Name: Albertsons Companies, Inc.
norm: albertsons companies
Domain: albertsonscompanies.com

Name: Albertsons Companies, Inc.
norm: albertsons companies
Domain: albertsonscompanies.com
Industry: Retail & Consumerllm

Discovered: Dec 23, 2022
Breach occurred: Dec 22, 2022 – Dec 24, 2022
Undetected for: 1 dayoccurrence → discovery
Materiality determined: —
Notification sent: Apr 21, 2023
Affected individuals: 1,882state-resident count only
Data types: Identity (basic)
Data elements: NameSocial Security numberDriver's licence numberFinancial account numberDate of birthHealth insurance IDMedical information
WA-stated cause: Cyberattack
WA-stated duration: lifecycle 1-99dexposure 1-99d
WA-stated discovery: Found while ongoing
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: contacted law enforcement

During the incident: Launched a forensic investigation
Took steps to prevent any further unauthorized access
Engaged a leading global forensics firm
Contacted law enforcement
Changes made: Enhance our security and monitoring controls
Harden our systems as appropriate to minimize the risk of any similar incident in the future
Offered credit monitoring services for a period of 12/24 months
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 17 weeks(118 days from discovery to filing)
Compliance flags: WA AG >90d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 9 filings · 9 states

View merged incident ↗

Vermont State AGApr 13 · first

California State AG+7d

Washington State AG+7d · this page

Oregon State AG+8d

Indiana State AG+8d

Massachusetts State AG+8d

Montana State AG+8d

Maine State AG+8d

New Hampshire State AG+8d

Pattern: first filing Apr 13 (VT), last Apr 21 (NH) — a 8-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA21832.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 20, 2023
Raw hash: 64610c019f4b4068ed3ad394f54561ef843d499db007472341501c1a079464b2

Linked disclosures

Regulatory filings (8) · sorted by filing gap

Reporting entityAlbertsons Companies, Inc.

Victim entityAlbertsons Companies, Inc.

Incidentdiscovered Dec 23, 2022

Stated responseLaunched a forensic investigation

ComplianceWA AG >90d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com