DisclosureLens
MalwareManufacturingManufacturingRansomwareStolen CredentialsData ExfiltratedData PublishedCustomer Data InvolvedDelayed DiscoveryIdentity (basic)Government IDFinancial accountMediumContained

Wabtec Corporation

bd_609e558e001a5da5 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jun 26, 2022

Filed

Jan 4, 2024

To disclose

19 months

Affected

Not disclosed

Linked

8 records

Confidence

64%

Wabtec Corporation experienced a cyber incident where malware was introduced into systems as early as March 15, 2022. The company became aware of unusual activity on June 26, 2022. Forensic investigation revealed unauthorized access and data exfiltration, with some data later posted to a threat actor's leak site. Affected individuals' information included names and potentially Social Security numbers, credit/debit card numbers, or bank account numbers. Wabtec engaged cybersecurity firms, notified the FBI, implemented additional safeguards, and offered 24 months of credit monitoring.

Leak gap clock✗ Leak >180d19 months discovery → filing

Incident timeline

undetected · 103 days
discovery → filing · 19 months / 557 days

Mar 15, 2022

Begins

Jun 26, 2022

Discovered

Jan 4, 2024

Filed

This filing is one of 8 records about the same incident.View merged incident
A leak claim by lockbit_3 about this victim was first seen 504 days before this filing.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (1)

Regulatory filings (6) · sorted by filing gap

Show 2 more filings ↓up to 370d gap

Filing propagation · 7 filings · 7 states

View merged incident ↗
Indiana State AGDec 30 · first
Montana State AGDec 30 · first
New Hampshire State AGDec 30 · first
Maine State AGDec 30 · first
Massachusetts State AGDec 30 · first
California State AG+370d · this page

Pattern: first filing Dec 30 (IN), last Jan 4 (CA) — a 370-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.