Social EngineeringRetail & ConsumerRetailPhishingStolen CredentialsCustomer Data InvolvedTargetedIdentity (basic)Government IDMediumContained

Fedway Associates

bd_6e19b51f5e364ed2 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Sep 22, 2023

Filed

Dec 7, 2023

To disclose

11 weeks

Affected

1state residents only

Linked

3 filings

Confidence

67%

Full breach record for Fedway Associates →

Fedway Associates, Inc. notified Montana residents of a cybersecurity incident discovered on September 22, 2023, involving unauthorized access to an employee email account. The incident likely exposed names and Social Security numbers. The company engaged forensic specialists, secured its network, reported the incident to federal law enforcement, and offered one year of complimentary identity monitoring via Kroll.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 11 weeks / 76 days

Sep 22, 2023

Discovered

Dec 7, 2023

Filed

vs. sector median

+3 wks slower

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Maine State AGbd_211a021948d5d8302023-12-07Candidate
Massachusetts State AGbd_548e830b9dc05d5d2023-12-07Verified

Name: Fedway Associates
norm: fedway associates

Name: Fedway Associates
norm: fedway associates
Industry: Retail & Consumerllm

Discovered: Sep 22, 2023
Materiality determined: —
Notification sent: —
Affected individuals: 1state-resident count only
Data types: Identity (basic)Government ID
Data elements: Social Security number
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid AccountsT1114 Email Collection
Threat actor: ExternalFinancial
Regulator citations: Reported incident to federal law enforcement
Initial access: phishing_link

During the incident: Engaged third-party forensic specialists to investigate
Secured email system and network
Reported incident to federal law enforcement
Secured services of Kroll to provide identity monitoring at no cost for one year
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 11 weeks(76 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Maine State AGDec 7 · first

Massachusetts State AGDec 7 · first

Montana State AGDec 7 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-notification-letter-924.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 7, 2023
Raw hash: c7d941bbc840233eedbfb2fd24eaa84281ff63e33fbab48f26bc541f1469a8cc

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityFedway Associates

Victim entityFedway Associates

Incidentdiscovered Sep 22, 2023

Stated responseEngaged third-party forensic specialists to investigate

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov