MalwareManufacturingManufacturingRansomwareData EncryptedSupply Chain (3P Vendor)PIIFinancial accountLowContained

S&K Manufacturing, Inc.

bd_71f49d85d8fd5c39 · schema v1 · pii pii-v1

Severity

Low

Discovered

Mar 1, 2022

Filed

Feb 21, 2023

To disclose

51 weeks

Affected

Not disclosed

Linked

6 filings

Confidence

67%

Full breach record for S&K Manufacturing, Inc. →

S&K Manufacturing, Inc. notified consumers of a data breach involving its third-party MSP, Freestyle Solutions. An unknown actor accessed the MSP's server between Sept 2020 and Feb 2022, installing malware and potentially accessing payment card info. Only 3 Rhode Island residents were explicitly identified as impacted in this filing.

J jump to incidentP pin to compareR raw source

Vermont clock✗ VT AG >45 bday51 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 529 days

discovery → filing · 51 weeks / 357 days

Sep 18, 2020

Begins

Mar 1, 2022

Discovered

Feb 21, 2023

Filed

This filing is one of 6 filings about the same incident.View merged incident

Part of FreeStyle Solutions supply-chain incident (2022) — a supply-chain cascade affecting multiple organizations.View cascade →

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Montana State AGbd_57256c900826f3412023-02-21Candidate
Maine State AGbd_83f8ada93beed0ec2023-02-21Verified by operator
Indiana State AGbd_92bee0ce35ced0df2023-02-21Verified by operator
Massachusetts State AGbd_95f202a7c0575cdb2023-02-21Verified

Show 1 more filing ↓up to 6d gap

New Hampshire State AGbd_3176301c03b212c32023-02-27 · +6dVerified by operator

Name: S&K Manufacturing, Inc.
norm: s k manufacturing

Name: S&K Manufacturing, Inc.
norm: s k manufacturing
Industry: Manufacturingllm

Discovered: Mar 1, 2022
Breach occurred: Sep 18, 2020 – Feb 3, 2022
Undetected for: 529 daysoccurrence → discovery
Materiality determined: —
Notification sent: Feb 21, 2023
Affected individuals: Not disclosed
Data types: PIIFinancial account
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1078 Valid Accounts
Threat actor: ExternalFinancial
Third party: via Freestyle Solutions
Initial access: external_remote_services

During the incident: Freestyle reports that it removed the malware within the environment and launched an investigation, aided by cybersecurity specialists
Decided to end our relationship with Freestyle and engage a new managed service provider
Changes made: Ended our relationship with Freestyle and engage a new managed service provider
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 51 weeks(357 days from discovery to filing)
Compliance flags: VT AG >45 bday
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

Montana State AGFeb 21 · first

Maine State AGFeb 21 · first

Indiana State AGFeb 21 · first

Massachusetts State AGFeb 21 · first

Vermont State AGFeb 21 · first · this page

New Hampshire State AG+6d

Pattern: first filing Feb 21 (MT), last Feb 27 (NH) — a 6-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ago.vermont.gov/document/2023-02-21-sk-manufacturing-data-breach-notice-consumers
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 21, 2023
Raw hash: 848899ab62152e4993bee8eacc715cc145d8df77b9b65e52206b0e08e6a13e0a

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityS&K Manufacturing, Inc.

Victim entityS&K Manufacturing, Inc.

Incidentdiscovered Mar 1, 2022

Stated responseFreestyle reports that it removed the malware within the environment and launched an investigation, aided by cybersecurity specialists

ComplianceVT AG >45 bday

Extraction provenanceno artifact recorded

Source provenanceago.vermont.gov