MalwareRetail & ConsumerManufacturingRetailRansomwareCapture Stored DataData ExfiltratedData EncryptedCustomer Data InvolvedEmployee Data InvolvedTargetedIdentity (basic)Government IDFinancialEmploymentMinorMediumContained

A. Duda & Sons Inc.

bd_6eb70b8dbaff7c05 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jul 9, 2022

Filed

Aug 3, 2022

To disclose

25 days

Affected

12state residents only

Linked

6 records

Confidence

65%

Full breach record for A. Duda & Sons Inc. →

A. Duda & Sons, Inc. disclosed a ransomware incident in June-July 2022 where attackers exploited IT systems, encrypted networks, and exfiltrated PII including SSNs and financial data. The company reported to law enforcement, engaged consultants, and offered credit monitoring. Exact scope of affected individuals is undetermined.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 38 days

discovery → filing · 25 days

Jun 1, 2022

Begins

Jul 9, 2022

Discovered

Aug 3, 2022

Filed

vs. sector median

6 wks faster

This filing is one of 6 records about the same incident.View merged incident

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Sitealphvbd_a8a3e06868deccd62022-07-14 · +20dVerified by operator

Regulatory filings (4) · sorted by filing gap

Oregon State AGbd_1a43af04930a557d2022-08-03Candidate
Indiana State AGbd_254bb0835280f5952022-08-03Verified
Montana State AGbd_4f72abedbcfb0cbb2022-08-03Verified
California State AGbd_c6a3c369757bfe9c2022-08-03Verified

Name: A. Duda & Sons Inc.
norm: a duda sons
Domain: duda.com

Name: A. Duda & Sons Inc.
norm: a duda sons
Domain: duda.com
Industry: Retail & ConsumerllmManufacturingllm

Discovered: Jul 9, 2022
Breach occurred: Jun 1, 2022 – Jul 31, 2022
Undetected for: 38 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 12state-resident count only
Data types: Identity (basic)Government IDFinancialEmploymentMinor
Data elements: Social Security numberDate of birth
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: DUDA reported the incident to law enforcement
Initial access: exploit_public_facing

During the incident: DUDA reported the incident to law enforcement
Cooperating with law enforcement investigating the attack
Working with outside consultants to strengthen our information security systems
Offering certain credit monitoring services at no cost
Changes made: Restore the functionality and security of its data systems
Working with outside consultants to strengthen our information security systems to reduce the risk of a similar attack in the future
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 25 days(25 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Oregon State AGAug 3 · first

Indiana State AGAug 3 · first

Montana State AGAug 3 · first

California State AGAug 3 · first

South Carolina State AGAug 3 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2022/ADuda%26SonsInc.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 3, 2022
Raw hash: dd85ad7b9b98bd0f0b7dbd8d54c941fe1a3a2184c3f80965768c22b833e0209c

Linked disclosures

Ransomware claims (1)

Regulatory filings (4) · sorted by filing gap

Reporting entityA. Duda & Sons Inc.

Victim entityA. Duda & Sons Inc.

Incidentdiscovered Jul 9, 2022

Stated responseDUDA reported the incident to law enforcement

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceconsumer.sc.gov