MalwareRetail & ConsumerManufacturingRetailRansomwareRansom DemandedData ExfiltratedIdentity (basic)Government IDFinancial accountMediumContained

Sporting Goods Division of Mitsubishi Chemical America, Inc.

bd_6797c90fe7539a11 · schema v1 · pii pii-v1

Severity

Medium

Discovered

May 19, 2023

Filed

Aug 1, 2023

To disclose

11 weeks

Affected

2state residents only

Confidence

66%

Full breach record for Sporting Goods Division of Mitsubishi Chemical America, Inc. →

Sporting Goods Division of Mitsubishi Chemical America, Inc. notified Montana residents of a May 19, 2023 ransomware attack. Unauthorized access to servers potentially exposed PII including SSNs, driver's licenses, and financial data. The company engaged forensic experts and provided 24 months of Experian IdentityWorks services to affected individuals.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 11 weeks / 74 days

May 19, 2023

Discovered

Aug 1, 2023

Filed

vs. sector median

+3 wks slower

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed2 affectedView incident

Name: Sporting Goods Division of Mitsubishi Chemical America, Inc.
norm: sporting goods division of mitsubishi chemical america

Name: Sporting Goods Division of Mitsubishi Chemical America, Inc.
norm: sporting goods division of mitsubishi chemical america
Industry: Retail & ConsumerllmManufacturingllm

Discovered: May 19, 2023
Materiality determined: —
Notification sent: Jul 1, 2023
Affected individuals: 2state-resident count only
Data types: Identity (basic)Government IDFinancial account
Data elements: Social Security numberDate of birth
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1078 Valid Accounts
Threat actor: ExternalFinancial
Initial access: valid_credentials

During the incident: Launched an investigation to determine the nature and scope of the activity
Working with cybersecurity experts to determine what happened
Commenced a thorough review to determine whether sensitive information was present
Working with industry-leading computer forensics experts to identify the information accessed
Ensure that the threat actors no longer have access to our systems and data
Arranged to make available to you 24 months of identity theft resolution services provided by Experian’s IdentityWorks at no charge
Changes made: Reviewing existing policies and procedures to protect against a similar future incident
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 11 weeks(74 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-notification-letter-500.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 1, 2023
Raw hash: 340697d72e353122dd8ddff6ee5ff448ff79ea046c5cb96114d5103ad57f58fc

Reporting entitySporting Goods Division of Mitsubishi Chemical America, Inc.

Victim entitySporting Goods Division of Mitsubishi Chemical America, Inc.

Incidentdiscovered May 19, 2023

Stated responseLaunched an investigation to determine the nature and scope of the activity

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov