MalwareTransportation & LogisticsTransportationRansomwareStolen CredentialsData ExfiltratedData EncryptedRansom DemandedCustomer Data InvolvedPIIIdentity (basic)Government IDFinancial accountMediumContained

Estes Express Lines

bd_5b50f6cebbb7f477 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Oct 1, 2023

Filed

Dec 1, 2023

To disclose

9 weeks

Affected

3state residents only

Linked

8 records

Confidence

67%

Full breach record for Estes Express Lines →

Estes Express Lines notified Montana residents of a ransomware incident discovered on October 1, 2023. An unauthorized actor accessed the IT network, encrypted data, and exfiltrated personal information including names, SSNs, and financial account details. Estes engaged forensic investigators, cooperated with the FBI, locked out the actor, and offered 12 months of credit monitoring via Kroll.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 9 weeks / 61 days

Oct 1, 2023

Discovered

Dec 1, 2023

Filed

This filing is one of 8 records about the same incident.View merged incident

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Sitelockbit_3bd_8133c0adbada28e22023-10-02 · +60dVerified by operator

Regulatory filings (6) · sorted by filing gap

Vermont State AGbd_f46705b840aae4762023-12-04 · +3dVerified by operator
Indiana State AGbd_dc7acd3bd675249c2023-12-05 · +4dVerified by operator
Maine State AGbd_c37017dcce54a7a92023-12-31 · +30dVerified by operator
California State AGbd_c81da27f4e5ac9a02023-12-31 · +30dVerified by operator

Show 2 more filings ↓up to 334d gap

Massachusetts State AGbd_dc748fba491cf3662024-02-11 · +72dVerified by operator
Illinois State AGbd_8133543266aa118c2023-01-01 · +334dVerified by operator

Name: Estes Express Lines
norm: estes express lines
Domain: estes-express.com

Name: Estes Express Lines
norm: estes express lines
Domain: estes-express.com
Industry: Transportation & Logisticsllm

Discovered: Oct 1, 2023
Materiality determined: —
Notification sent: —
Affected individuals: 3state-resident count only
Data types: PIIIdentity (basic)Government IDFinancial account
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 ChannelT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Cooperating with the FBI
Initial access: valid_credentials

During the incident: Engaged its incident response team, including a world-class third-party forensics, cybersecurity and recovery firm
Notifying and cooperating with the FBI
Successfully locking out the unauthorized threat actor from the Company’s system
Undertaking a full forensic investigation
Remediate the malware and harden the Company’s IT systems
Secured the services of Kroll to provide identity monitoring at no cost to you for 12 months
Changes made: Hardened the Company’s IT systems
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 9 weeks(61 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 7 filings · 7 states

View merged incident ↗

Illinois State AGJan 1 · first

Montana State AG+334d · this page

Vermont State AG+337d

Indiana State AG+338d

Maine State AG+364d

California State AG+364d

Massachusetts State AG+406d

Pattern: first filing Jan 1 (IL), last Feb 11 (MA) — a 406-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-notification-letter-903.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 1, 2023
Raw hash: fa7ad9d37ce0f18a03bb5a7bf4094d8912619331c7ef7885554d71e620fd620d

Linked disclosures

Ransomware claims (1)

Regulatory filings (6) · sorted by filing gap

Reporting entityEstes Express Lines

Victim entityEstes Express Lines

Incidentdiscovered Oct 1, 2023

Stated responseEngaged its incident response team, including a world-class third-party forensics, cybersecurity and recovery firm

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov