HackingRetail & ConsumerRetailData ExfiltratedTargetedIdentity (basic)Government IDHighContained

Fiskars Group

bd_71af1a5813a10fc8 · schema v1 · pii pii-v1

Severity

High

Discovered

Apr 26, 2024

Filed

Nov 6, 2024

To disclose

28 weeks

Affected · nationwide

6,3061 in this filing

Linked

9 filings

Confidence

65%

Full breach record for Fiskars Group →

Fiskars Group reported an external system breach (hacking) occurring between March 31 and May 1, 2024. Unauthorized access was discovered on April 26, 2024. The incident affected 6,306 individuals nationwide, including 1 Maine resident. Compromised data included names and Social Security numbers. Fiskars engaged third-party experts, notified law enforcement, and offered 24 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Apr 26, 2024 → Filed with AG Nov 6, 2024194d ✗ ME AG >90d28 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 26 days

discovery → filing · 28 weeks / 194 days

Mar 31, 2024

Begins

Apr 26, 2024

Discovered

Nov 6, 2024

Filed

vs. sector median

+20 wks slower

This filing is one of 9 about the same incident.View merged incident

Linked disclosures

Why this link?

Ransomware claims (2)

Leak Siteakirabd_15cc21711cdd37e02024-05-14 · +176dVerified by operator
Leak Siteakirabd_f93596bcd8001e912024-04-26 · +194dVerified by operator

Regulatory filings (6) · sorted by filing gap

Montana State AGbd_2546ee2e339cdcde2024-11-06Verified by operator
Oregon State AGbd_3585e5f80d5ec4cf2024-11-06Verified by operator
Massachusetts State AGbd_43f427ee9b5695042024-11-06Verified by operator
Vermont State AGbd_74a709a0860f528d2024-11-06Verified

Show 2 more filings ↓up to 194d gap

Indiana State AGbd_9eef7464f82ecc2a2024-11-06Verified by operator
Pressakirabd_60af196b5a2894472024-04-26 · +194dCandidate

Name: Norton Rose Fulbright
norm: norton rose fulbright
Domain: fiskarsgroup.com

Name: Fiskars Group
norm: fiskars group
Domain: fiskarsgroup.com
Industry: Retail & Consumerllm

Discovered: Apr 26, 2024
Breach occurred: Mar 31, 2024 – May 1, 2024
Undetected for: 26 daysoccurrence → discovery
Materiality determined: —
Notification sent: Nov 6, 2024
Affected individuals: 6,306state + nationwide
Data types: Identity (basic)Government ID
Data elements: Social Security number
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1078 Valid Accounts
Threat actor: External
Regulator citations: Filed notice with Maine Attorney General
Initial access: exploit_public_facing

During the incident: Engaged third-party cybersecurity experts
Notified law enforcement
Changes made: Implemented numerous measures designed to further enhance the security of our systems and data
Offering 24 months of Experian IdentityWorks credit monitoring and call center support
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 28 weeks(194 days from discovery to filing)
Compliance flags: ME AG >90d · 194dLeak >180dME resident >60d · 194d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Apr 26, 2024
→ Filed with AG: Nov 6, 2024
194d 90 days ME AG >90d
Maine
Discovered: Apr 26, 2024
→ Notified: Nov 6, 2024
194d 60 days (analyst band; statutory cap is 30 days) ME resident >60d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Apr 26, 2024 → Filed with AG: Nov 6, 2024	194d	90 days	ME AG >90d
Maine	Discovered: Apr 26, 2024 → Notified: Nov 6, 2024	194d	60 days (analyst band; statutory cap is 30 days)	ME resident >60d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 7 filings · 6 states

View merged incident ↗

PressApr 26 · first

Montana State AG+194d

Oregon State AG+194d

Massachusetts State AG+194d

Vermont State AG+194d

Indiana State AG+194d

Maine State AG+194d · this page

Pattern: first filing Apr 26, last Nov 6 (ME) — a 194-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/9b956070-0750-4813-9d5b-eb072df277ab.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 6, 2024
Raw hash: fbdd52ecfeb011144172e671147db783cf883707c4f7239535f439ec160c70d7

Linked disclosures

Ransomware claims (2)

Regulatory filings (6) · sorted by filing gap

Reporting entityNorton Rose Fulbright

Victim entityFiskars Group

Incidentdiscovered Apr 26, 2024

Stated responseEngaged third-party cybersecurity experts

ComplianceME AG >90d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov