HackingRetail & ConsumerRetailData ExfiltratedTargetedIdentity (basic)Government IDHighContained

Fiskars Group

bd_71af1a5813a10fc8 · schema v1 · pii pii-v1

Severity

High

Discovered

Apr 26, 2024

Filed

Nov 6, 2024

To disclose

28 weeks

Affected · nationwide

6,3061 in this filing

Linked

8 records

Confidence

65%

Full breach record for Fiskars Group →

Fiskars Group reported an external system breach (hacking) occurring between March 31 and May 1, 2024. Unauthorized access was discovered on April 26, 2024. The incident affected 6,306 individuals nationwide, including 1 Maine resident. Compromised data included names and Social Security numbers. Fiskars engaged third-party experts, notified law enforcement, and offered 24 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Leak gap clock⏱ Leak >90d28 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 26 days

discovery → filing · 28 weeks / 194 days

Mar 31, 2024

Begins

Apr 26, 2024

Discovered

Nov 6, 2024

Filed

vs. sector median

+18 wks slower

This filing is one of 8 records about the same incident.View merged incident

A leak claim by akira about this victim was first seen 176 days before this filing.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Siteakirabd_f93596bcd8001e912024-04-26 · +194dVerified by operator

Regulatory filings (5) · sorted by filing gap

Montana State AGbd_2546ee2e339cdcde2024-11-06Verified by operator
Oregon State AGbd_3585e5f80d5ec4cf2024-11-06Verified by operator
Massachusetts State AGbd_43f427ee9b5695042024-11-06Verified by operator
Vermont State AGbd_74a709a0860f528d2024-11-06Verified

Show 1 more filing ↓

Indiana State AGbd_9eef7464f82ecc2a2024-11-06Verified by operator

Press reports (1)

Pressakirabd_60af196b5a2894472024-04-26 · +194dCandidate

Name: Norton Rose Fulbright
norm: norton rose fulbright
Domain: fiskarsgroup.com

Name: Fiskars Group
norm: fiskars group
Domain: fiskarsgroup.com
Industry: Retail & Consumerllm

Discovered: Apr 26, 2024
Scope identified: Oct 15, 2024Maine’s notice clock starts here (10 M.R.S. §1348(1))The letter says: “On October 15, 2024, we completed our review and determined that some of your personal information was contained in the files, including your name and Social Security number.”
Breach occurred: Mar 31, 2024 – May 1, 2024
Undetected for: 26 daysoccurrence → discovery
Materiality determined: —
Notification sent: Nov 6, 2024
Affected individuals: 6,306state + nationwide
Data types: Identity (basic)Government ID
Data elements: Social Security number
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1078 Valid Accounts
Threat actor: External
Regulator citations: Filed notice with Maine Attorney General
Initial access: exploit_public_facing

During the incident: Engaged third-party cybersecurity experts
Notified law enforcement
Changes made: Implemented numerous measures designed to further enhance the security of our systems and data
Offering 24 months of Experian IdentityWorks credit monitoring and call center support
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 28 weeks(194 days from discovery to filing)
Compliance flags: Leak >90dME AG ≤30d · 22d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Scope identified: Oct 15, 2024
→ Filed with AG: Nov 6, 2024
22d 30 days ME AG ≤30d

Statute	Window	Elapsed	Threshold	Status
Maine	Scope identified: Oct 15, 2024 → Filed with AG: Nov 6, 2024	22d	30 days	ME AG ≤30d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

Montana State AGNov 6 · first

Oregon State AGNov 6 · first

Massachusetts State AGNov 6 · first

Vermont State AGNov 6 · first

Indiana State AGNov 6 · first

Maine State AGNov 6 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/9b956070-0750-4813-9d5b-eb072df277ab.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 6, 2024
Raw hash: fbdd52ecfeb011144172e671147db783cf883707c4f7239535f439ec160c70d7

Linked disclosures

Ransomware claims (1)

Regulatory filings (5) · sorted by filing gap

Press reports (1)

Reporting entityNorton Rose Fulbright

Victim entityFiskars Group

Incidentdiscovered Apr 26, 2024

Stated responseEngaged third-party cybersecurity experts

ComplianceLeak >90d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov