HackingCustomer Data InvolvedDelayed DiscoveryIDENTITY_BASICIDENTITY_GOVERNMENTFINANCIAL_ACCOUNTMediumContained
Empire Distribution USA
bd_6a44767cad24fcf7 · schema v1 · pii pii-v1
Full breach record for Empire Distribution USA →EMPIRE Distribution Inc. disclosed a cyber incident where an unknown third party accessed internal systems. The breach occurred on November 17, 2024, but was not discovered until July 7, 2025. Affected data may include names, Social Security numbers, and bank account numbers. The company engaged cybersecurity experts, notified federal law enforcement, and is offering two years of credit monitoring to affected individuals.
California clockDiscovered Jul 7, 2025 → Notified Sep 25, 202580d ✗ CA 60-day late12 weeks discovery → filing
This filing is one of 5 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (4) · sorted by filing gap
- bd_9b7753225c6a7789Maine State AGfiled 2025-09-26Candidate
- bd_020c3b5bcc312142New Hampshire State AGfiled 2025-09-30(4d gap)Verified
- bd_3162e72c47adb9ffVermont State AGfiled 2025-08-29(28d gap)Verified
- bd_c20c84711159dc9eIndiana State AGfiled 2025-08-29(28d gap)Verified
Source provenance
- Source URL
- https://oag.ca.gov/ecrime/databreach/reports/sb24-610597
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Sep 26, 2025
- Raw hash
- 02abcfd778b9834d4a8ec9bb2e7b56c347591f7b1b01e888b6b8ea016f4f291e
Reporting entity
- Name
- Empire Distribution USAnorm: empire distribution usa
- Domain
- empiredistributionusa.com
Victim entity
- Name
- Empire Distribution USAnorm: empire distribution usa
- Domain
- empiredistributionusa.com
Incident
- Discovered
- Jul 7, 2025
- Materiality determined
- —
- Notification sent
- Sep 25, 2025
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENTFINANCIAL_ACCOUNT
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1078 Valid Accounts
- Threat actor
- External
- Regulator citations
- Informed federal law enforcement of this incident
Compliance
- Time to disclose
- 12 weeks(81 days from discovery to filing)
- Compliance flags
- CA 60-day late · 80d
- Discovery-date grounding
- letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
- Clock breakdown
Statute Window Elapsed Threshold Status California Discovered: Jul 7, 2025→ Notified: Sep 25, 202580d 60 days (analyst band, pre-2026 discoveries) CA 60-day late
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.