MalwareRetail & ConsumerRetailRansomwareData ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDMediumContained

Tom James Company

bd_5f091cf4bf585881 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Aug 1, 2022

Filed

Feb 17, 2023

To disclose

29 weeks

Affected

Not disclosed

Linked

5 filings

Confidence

67%

Full breach record for Tom James Company →

Tom James Company experienced a ransomware incident in August 2022. An unauthorized actor claimed to have accessed and/or acquired certain files. The investigation determined that names and Social Security numbers may have been affected. The company secured its network, reported to federal law enforcement, and is offering 12 months of credit monitoring through Experian.

J jump to incidentP pin to compareR raw source

Vermont clock✗ VT AG >45 bday29 weeks discovery → filing

Incident timeline

discovery → filing · 29 weeks / 200 days

Aug 1, 2022

Discovered

Feb 17, 2023

Filed

vs. sector median

+19 wks slower

This filing is one of 5 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Maine State AGbd_60497f4ff76efd972023-02-17Candidate
Indiana State AGbd_678d9dcd02ad63462023-02-17Verified
Massachusetts State AGbd_dbf04af71d99807f2023-02-17Verified
Montana State AGbd_dec2114b968e344d2023-02-17Verified

Name: Tom James Company
norm: tom james

Name: Tom James Company
norm: tom james
Industry: Retail & Consumerllm

Discovered: Aug 1, 2022
Materiality determined: —
Notification sent: Feb 17, 2023
Affected individuals: Not disclosed
Data types: Identity (basic)Government ID
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Notifying relevant regulatory authorities, as requiredReported this event to federal law enforcement

During the incident: Took steps to secure our network
Began an investigation to determine the nature and scope of the activity
Undertook a comprehensive review of the potentially-impacted data
Reported this event to federal law enforcement
Offering access to credit monitoring and identity theft protection services for twelve (12) months through Experian at no cost
Changes made: Reviewing and enhancing our existing policies and procedures relating to data protection and security
Institute additional security measures
Provide additional training to employees
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 29 weeks(200 days from discovery to filing)
Compliance flags: VT AG >45 bday
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Maine State AGFeb 17 · first

Indiana State AGFeb 17 · first

Massachusetts State AGFeb 17 · first

Montana State AGFeb 17 · first

Vermont State AGFeb 17 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ago.vermont.gov/document/2023-02-17-tom-james-data-breach-notice-consumers
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 17, 2023
Raw hash: 1d5ccfc2c651798db2737389dc5d40d9871b4e8700a7309a4e5ac7cccf0bfe18

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityTom James Company

Victim entityTom James Company

Incidentdiscovered Aug 1, 2022

Stated responseTook steps to secure our network

ComplianceVT AG >45 bday

Extraction provenanceno artifact recorded

Source provenanceago.vermont.gov