HackingRetail & ConsumerRetailStolen CredentialsData ExfiltratedIdentity (basic)Government IDMediumContained

Fiskars Group

bd_74a709a0860f528d · schema v1 · pii pii-v1

Severity

Medium

Discovered

Apr 26, 2024

Filed

Nov 6, 2024

To disclose

28 weeks

Affected

Not disclosed

Linked

9 filings

Confidence

66%

Full breach record for Fiskars Group →

Fiskars Group notified consumers of a cybersecurity incident discovered on April 26, 2024. An unauthorized actor accessed systems between March 31 and April 8, 2024, obtaining files containing names and Social Security numbers. Fiskars engaged third-party experts, notified law enforcement, and is offering 24 months of Experian IdentityWorks.

J jump to incidentP pin to compareR raw source

Vermont clock✗ VT AG >45 bday28 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 26 days

discovery → filing · 28 weeks / 194 days

Mar 31, 2024

Begins

Apr 26, 2024

Discovered

Nov 6, 2024

Filed

vs. sector median

+20 wks slower

This filing is one of 9 about the same incident.View merged incident

A leak claim by akira about this victim predates this filing by 194 days.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (2)

Leak Siteakirabd_15cc21711cdd37e02024-05-14 · +176dVerified by operator
Leak Siteakirabd_f93596bcd8001e912024-04-26 · +194dVerified by operator

Regulatory filings (6) · sorted by filing gap

Montana State AGbd_2546ee2e339cdcde2024-11-06Verified by operator
Oregon State AGbd_3585e5f80d5ec4cf2024-11-06Verified by operator
Massachusetts State AGbd_43f427ee9b5695042024-11-06Verified by operator
Maine State AGbd_71af1a5813a10fc82024-11-06Verified by operator

Show 2 more filings ↓up to 194d gap

Indiana State AGbd_9eef7464f82ecc2a2024-11-06Verified by operator
Pressakirabd_60af196b5a2894472024-04-26 · +194dCandidate

Name: Fiskars Group
norm: fiskars group
Domain: fiskarsgroup.com

Name: Fiskars Group
norm: fiskars group
Domain: fiskarsgroup.com
Industry: Retail & Consumerllm

Discovered: Apr 26, 2024
Breach occurred: Mar 31, 2024 – Apr 8, 2024
Undetected for: 26 daysoccurrence → discovery
Materiality determined: —
Notification sent: Nov 6, 2024
Affected individuals: Not disclosed
Data types: Identity (basic)Government ID
Data elements: Social Security number
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1119 Automated Collection
Threat actor: External
Initial access: valid_credentials

During the incident: Engaged third-party cybersecurity experts
Notified law enforcement
Changes made: Implemented numerous measures designed to further enhance the security of systems and data
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 28 weeks(194 days from discovery to filing)
Compliance flags: VT AG >45 bdayLeak >180d
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 7 filings · 6 states

View merged incident ↗

PressApr 26 · first

Montana State AG+194d

Oregon State AG+194d

Massachusetts State AG+194d

Maine State AG+194d

Indiana State AG+194d

Vermont State AG+194d · this page

Pattern: first filing Apr 26, last Nov 6 (VT) — a 194-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ago.vermont.gov/document/2024-11-06-fiskars-group-data-breach-notice-consumers
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 6, 2024
Raw hash: 2f048d2d42fbd05d9becd87ddbf098951442105c1b8841f432d27e636df9cf3d

Linked disclosures

Ransomware claims (2)

Regulatory filings (6) · sorted by filing gap

Reporting entityFiskars Group

Victim entityFiskars Group

Incidentdiscovered Apr 26, 2024

Stated responseEngaged third-party cybersecurity experts

ComplianceVT AG >45 bday

Extraction provenanceno artifact recorded

Source provenanceago.vermont.gov