HackingRetail & ConsumerRetailStolen CredentialsData ExfiltratedIdentity (basic)Government IDMediumContained

Fiskars Group

bd_74a709a0860f528d · schema v1 · pii pii-v1

Severity

Medium

Discovered

Apr 26, 2024

Filed

Nov 6, 2024

To disclose

28 weeks

Affected

Not disclosed

Linked

8 records

Confidence

66%

Full breach record for Fiskars Group →

Fiskars Group notified consumers of a cybersecurity incident discovered on April 26, 2024. An unauthorized actor accessed systems between March 31 and April 8, 2024, obtaining files containing names and Social Security numbers. Fiskars engaged third-party experts, notified law enforcement, and is offering 24 months of Experian IdentityWorks.

J jump to incidentP pin to compareR raw source

Vermont clock✗ VT AG >45 bday28 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 26 days

discovery → filing · 28 weeks / 194 days

Mar 31, 2024

Begins

Apr 26, 2024

Discovered

Nov 6, 2024

Filed

vs. sector median

+18 wks slower

This filing is one of 8 records about the same incident.View merged incident

A leak claim by akira about this victim was first seen 176 days before this filing.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Siteakirabd_f93596bcd8001e912024-04-26 · +194dVerified by operator

Regulatory filings (5) · sorted by filing gap

Montana State AGbd_2546ee2e339cdcde2024-11-06Verified by operator
Oregon State AGbd_3585e5f80d5ec4cf2024-11-06Verified by operator
Massachusetts State AGbd_43f427ee9b5695042024-11-06Verified by operator
Maine State AGbd_71af1a5813a10fc82024-11-06Verified by operator

Show 1 more filing ↓

Indiana State AGbd_9eef7464f82ecc2a2024-11-06Verified by operator

Press reports (1)

Pressakirabd_60af196b5a2894472024-04-26 · +194dCandidate

Name: Fiskars Group
norm: fiskars group
Domain: fiskarsgroup.com

Name: Fiskars Group
norm: fiskars group
Domain: fiskarsgroup.com
Industry: Retail & Consumerllm

Discovered: Apr 26, 2024
Breach occurred: Mar 31, 2024 – Apr 8, 2024
Undetected for: 26 daysoccurrence → discovery
Materiality determined: —
Notification sent: Nov 6, 2024
Affected individuals: Not disclosed
Data types: Identity (basic)Government ID
Data elements: Social Security number
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1119 Automated Collection
Threat actor: External
Initial access: valid_credentials

During the incident: Engaged third-party cybersecurity experts
Notified law enforcement
Changes made: Implemented numerous measures designed to further enhance the security of systems and data
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 28 weeks(194 days from discovery to filing)
Compliance flags: VT AG >45 bdayLeak >90d
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

Montana State AGNov 6 · first

Oregon State AGNov 6 · first

Massachusetts State AGNov 6 · first

Maine State AGNov 6 · first

Indiana State AGNov 6 · first

Vermont State AGNov 6 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ago.vermont.gov/document/2024-11-06-fiskars-group-data-breach-notice-consumers
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 6, 2024
Raw hash: 2f048d2d42fbd05d9becd87ddbf098951442105c1b8841f432d27e636df9cf3d

Linked disclosures

Ransomware claims (1)

Regulatory filings (5) · sorted by filing gap

Press reports (1)

Reporting entityFiskars Group

Victim entityFiskars Group

Incidentdiscovered Apr 26, 2024

Stated responseEngaged third-party cybersecurity experts

ComplianceVT AG >45 bday

Extraction provenanceno artifact recorded

Source provenanceago.vermont.gov