MalwareGovernmentGovernmentRansomwareData ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDMediumContained

WSSC Water

bd_70e2ab39b1c5177f · schema v1 · pii pii-v1

Severity

Medium

Discovered

May 24, 2021

Filed

Jul 30, 2021

To disclose

10 weeks

Affected

Not disclosed

Linked

5 filings

Confidence

66%

Full breach record for WSSC Water →2 incidents on file

WSSC Water notified residents of a May 24, 2021 ransomware incident. While the virus was halted, unauthorized access occurred prior to the attack, exposing customer names and government IDs. WSSC reported to the FBI and MD AG, offered 5 years of credit monitoring, and is reviewing security policies. The incident was contained, and services were not impacted.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 10 weeks / 67 days

May 24, 2021

Discovered

Jul 30, 2021

Filed

This filing is one of 5 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

South Carolina State AGbd_b9273b8e285944392021-08-02 · +3dVerified
Oregon State AGbd_df0fb84769c435822021-08-02 · +3dVerified
Montana State AGbd_105a5811ddf35e4f2021-07-26 · +4dCandidate
California State AGbd_99b0a93e4b4a23312021-08-17 · +18dVerified

Name: WSSC Water
norm: wssc water
Domain: wsscwater.com

Name: WSSC Water
norm: wssc water
Domain: wsscwater.com
Industry: Governmentllm

Discovered: May 24, 2021
Materiality determined: —
Notification sent: Jul 26, 2021
Affected individuals: Not disclosed
Data types: Identity (basic)Government ID
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1119 Automated Collection
Threat actor: ExternalFinancial
Regulator citations: Reported this incident to the FBI and Maryland Attorney GeneralCooperate with any investigation by law enforcement

During the incident: Offered five (5) years of credit and identity monitoring with $1,000,000 in identity theft insurance at no cost
Secured systems and conducted a comprehensive investigation
Reported this incident to the FBI and Maryland Attorney General
Reviewing policies, procedures, and processes related to storage of and access to personal information
Notifying impacted individuals associated with sensitive information
Changes made: Reviewing policies, procedures, and processes related to storage of and access to personal information
Confirming the security of WSSC Water’s systems
Reviewing the contents of relevant data for sensitive information
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 10 weeks(67 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Montana State AGJul 26 · first

Delaware State AG+4d · this page

South Carolina State AG+7d

Oregon State AG+7d

California State AG+22d

Pattern: first filing Jul 26 (MT), last Aug 17 (CA) — a 22-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://attorneygeneral.delaware.gov/wp-content/uploads/sites/50/2021/08/WSSC-Water-Courtesy-Notice-to-Residents.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 30, 2021
Raw hash: caeb934ce521122f9035d04006ea0a0728e2613714887f7c7a9ae1ce2721d543

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityWSSC Water

Victim entityWSSC Water

Incidentdiscovered May 24, 2021

Stated responseOffered five (5) years of credit and identity monitoring with $1,000,000 in identity theft insurance at no cost

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceattorneygeneral.delaware.gov