MalwareManufacturingRetail & ConsumerManufacturingRansomwareData EncryptedTargetedIdentity (basic)Government IDMediumContained

Nature's Path Foods, Inc

bd_72b673ebfbc2cf41 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Mar 24, 2023

Filed

Oct 31, 2023

To disclose

32 weeks

Affected

516state residents only

Linked

6 filings

Confidence

70%

Full breach record for Nature's Path Foods, Inc →

Nature’s Path Foods, Inc. reported a ransomware cyberattack affecting 516 Washington residents. The breach occurred between January 7 and March 24, 2023, and was discovered on March 24, 2023. Affected data included names and government IDs (SSN, driver's license). The company offered 12 months of credit monitoring via Equifax.

J jump to incidentP pin to compareR raw source

Washington clock✗ WA AG >90d32 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 76 days

discovery → filing · 32 weeks / 221 days

Jan 7, 2023

Begins

Mar 24, 2023

Discovered

Oct 31, 2023

Filed

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Vermont State AGbd_4b6baf30edcf3bfc2023-10-31Candidate
Indiana State AGbd_87a54c62e0c1e0802023-10-31Verified
Massachusetts State AGbd_bb1f9efdab89b7ec2023-10-31Verified
Montana State AGbd_f0fe8126fa1ec1e22023-10-31Verified

Show 1 more filing ↓up to 8d gap

New Hampshire State AGbd_7d0c7a85f784fc692023-11-08 · +8dVerified

Name: Nature's Path Foods, Inc
norm: nature s path foods

Name: Nature's Path Foods, Inc
norm: nature s path foods
Industry: ManufacturingllmRetail & Consumerllm

Discovered: Mar 24, 2023
Breach occurred: Jan 7, 2023 – Mar 24, 2023
Undetected for: 76 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 516state-resident count only
Data types: Identity (basic)Government ID
Data elements: NameSocial Security numberDate of birth
WA-stated cause: Cyberattack
WA-stated duration: lifecycle 1-99dexposure 1-99d
WA-stated discovery: Found while ongoingContained same day
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for Impact
Threat actor: ExternalFinancial
Regulator citations: Filed breach notification with Washington State Attorney General

During the incident: Offering 12-month complimentary credit monitoring membership through Equifax
Providing additional information on steps to take in response to the incident
Contacting credit reporting agencies (Equifax, Experian, TransUnion) for security freezes and fraud alerts
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 32 weeks(221 days from discovery to filing)
Compliance flags: WA AG >90d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

Vermont State AGOct 31 · first

Indiana State AGOct 31 · first

Massachusetts State AGOct 31 · first

Montana State AGOct 31 · first

Washington State AGOct 31 · first · this page

New Hampshire State AG+8d

Pattern: first filing Oct 31 (VT), last Nov 8 (NH) — a 8-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA26899.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 31, 2023
Raw hash: 3d887140119537b84c41d782597d9d98e6ab1b55da8429380ba9cbaa8a37471e

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityNature's Path Foods, Inc

Victim entityNature's Path Foods, Inc

Incidentdiscovered Mar 24, 2023

Stated responseOffering 12-month complimentary credit monitoring membership through Equifax

ComplianceWA AG >90d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com