HackingCustomer Data InvolvedIDENTITY_BASICIDENTITY_GOVERNMENTCriticalResolved
SYSCO CORPORATION
bd_5d5516fe15b8939c · schema v1 · pii pii-v1
Full breach record for SYSCO CORPORATION →Sysco Corporation reported an external system breach (hacking) occurring on January 14, 2023, discovered on March 5, 2023. The incident affected 126,243 individuals, including 667 Maine residents. Compromised data included names and Social Security Numbers. The company provided 24 months of credit monitoring and fraud remediation via Experian IdentityWorks.
Maine clockDiscovered Mar 5, 2023 → Filed with AG May 17, 202373d ⏱ ME AG >30d10 weeks discovery → filing
⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.
This filing is one of 5 about the same incident.View merged incident
A leak claim by qilin about this victim predates this filing by 73 days.View originating leak claim
Linked disclosures
Why this link?Ransomware claims (2)
- bd_23944c2708911155Leak Sitedunghillfiled 2023-05-27(10d gap)Verified by operator
- bd_a1c15c7c0875d3f0Leak Siteqilinfiled 2023-03-05(73d gap)Candidate
Regulatory filings (2) · sorted by filing gap
- bd_44c863a405c6225fWashington State AGfiled 2023-05-17Verified
- bd_3041dfe2cdc8303fOregon State AGfiled 2023-05-16(1d gap)Verified
Source provenance
- Source URL
- https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/28ded7f7-4f72-4a32-b531-1ba31469d1aa.shtml
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- May 17, 2023
- Raw hash
- 57c4573e74276496a51b616cf94252c26f7334b80d9b9cd3b9f4c8d541900611
Reporting entity
- Name
- SYSCO CORPORATIONnorm: sysco
- Domain
- sysco.com
Victim entity
- Name
- SYSCO CORPORATIONnorm: sysco
- Domain
- sysco.com
Incident
- Discovered
- Mar 5, 2023
- Materiality determined
- —
- Notification sent
- May 5, 2023
- Affected individuals
- 126,243
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENT
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1190 Exploit Public-Facing ApplicationT1078 Valid Accounts
- Threat actor
- ExternalFinancial
- Regulator citations
- Notified Maine Attorney General
- Initial access
- exploit_public_facing
Compliance
- Time to disclose
- 10 weeks(73 days from discovery to filing)
- Compliance flags
- ME AG >30d · 73dME resident >60d · 61dLeak >30d
- Discovery-date grounding
- AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.
- Clock breakdown
Statute Window Elapsed Threshold Status Maine Discovered: Mar 5, 2023→ Filed with AG: May 17, 202373d 30 days (soft) ME AG >30d Maine Discovered: Mar 5, 2023→ Notified: May 5, 202361d 60 days (analyst band; statutory cap is 30 days) ME resident >60d
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.