MalwareTechnologyInformationRansomwarePlayData EncryptedCustomer Data InvolvedIdentity (basic)Government IDFinancial accountHealth (basic)PHIMediumContained

Oldenburg Group Incorporated

bd_6312e01945e8bffb · schema v1 · pii pii-v1

Severity

Medium

Discovered

—

Filed

Jul 2, 2024

To disclose

—

Affected

Not disclosed

Linked

4 filings

Confidence

68%

Full breach record for Oldenburg Group Incorporated →

Oldenburg Group Incorporated experienced a ransomware incident between May 4-5, 2024, attributed to the Play ransomware group. Attackers installed ransomware on primary servers, potentially accessing personal information including names, SSNs, driver's license numbers, financial account info, and health insurance data. The company secured servers, launched an investigation with third-party forensics, and is offering 12 months of credit monitoring. It is unclear if data was exfiltrated.

J jump to incidentP pin to compareR raw source

Incident timeline

May 4, 2024

Begins

Jul 2, 2024

Filed

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

New Hampshire State AGPlaybd_3326bcd4b93285532024-07-03 · +1dVerified
Indiana State AGbd_14918c6df2efebf02024-05-30 · +33dVerified
Maine State AGPlaybd_c38202311c38d9a72024-09-10 · +70dVerified

Name: Oldenburg Group Incorporated
norm: oldenburg group

Name: Oldenburg Group Incorporated
norm: oldenburg group
Industry: Technologyllm

Discovered: —
Breach occurred: May 4, 2024 – May 5, 2024
Materiality determined: —
Notification sent: Jul 2, 2024
Affected individuals: Not disclosed
Data types: Identity (basic)Government IDFinancial accountHealth (basic)PHI
Data elements: Social Security numberDate of birthMedical information
Attack vector: Ransomware· Play
MITRE ATT&CK: T1486 Data Encrypted for Impact
Threat actor: PlayExternalFinancial

During the incident: Took steps to secure the servers
Launched an investigation
Retained third-party forensics
Retained third-party IT services
Retained outside counsel
Offering 12 months of credit monitoring and identity protection services through IDX Identity
Changes made: Taking steps to enhance our existing security protocols
Rebuild our system
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Indiana State AGMay 30 · first

Vermont State AG+33d · this page

New Hampshire State AG+34d

Maine State AG+103d

Pattern: first filing May 30 (IN), last Sep 10 (ME) — a 103-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ago.vermont.gov/document/2024-07-02-oldenburg-group-data-breach-notice-consumers
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 2, 2024
Raw hash: 0e6bd5dd4381e98c33e823ed0c39437c2c936637eda9822abec987dc1903035a

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityOldenburg Group Incorporated

Victim entityOldenburg Group Incorporated

IncidentRansomware

Stated responseTook steps to secure the servers

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceago.vermont.gov