MalwareGovernmentTransportation & LogisticsGovernmentRansomwareLockBit 2.0Ransom DemandedData ExfiltratedTargetedPIIIdentity (basic)LowActive

Valley Regional Transit

bd_76e9b90595f5b324 · schema v1 · pii pii-v1

Severity

Low

Discovered

Oct 14, 2021

Filed

Oct 19, 2021

To disclose

5 days

Affected

Not disclosed

Linked

4 filings

Confidence

64%

Full breach record for Valley Regional Transit →

Valley Regional Transit (VRT) notified the Idaho AG of a ransomware incident involving LockBit 2.0 discovered on Oct 14, 2021. VRT engaged forensic investigators and law enforcement (FBI, DHS/TSA). Threat actors claimed to have exfiltrated personal information and demanded ransom. VRT is restoring from backups and deploying EDR tools. No payroll or service interruptions reported.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 5 days

Oct 14, 2021

Discovered

Oct 19, 2021

Filed

vs. sector median

10 wks faster

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Idaho State AGbd_5bbda4e6f2ce65d82022-01-14 · +87dVerified
Montana State AGbd_1d005beea990e2072022-01-21 · +94dVerified
Massachusetts State AGbd_4f4d74fbdd5c0fb72022-01-25 · +98dVerified

Name: ECKERT SEAMANS CHERIN & MELLOTT, LLC
norm: eckert seamans cherin mellott

Name: Valley Regional Transit
norm: valley regional transit
Industry: GovernmentllmTransportation & Logisticsllm

Discovered: Oct 14, 2021
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: PIIIdentity (basic)
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 Channel
Threat actor: LockBit 2.0ExternalFinancial
Regulator citations: Notified the Office of the Attorney General of IdahoCooperating with the Federal Bureau of Investigation (FBI)Cooperating with the Transportation Security Administration (TSA) / U.S. Department of Homeland Security (DHS)

During the incident: Engaged legal counsel with an expertise in cybersecurity
Hired a nationally-recognized cyber security and digital forensics firm to assist with the investigation
Deploying Sentinel One, an endpoint detection and response tool
Communicated with the Federal Bureau of Investigation (FBI)
Communicated with the Transportation Security Administration (TSA) / U.S. Department of Homeland Security (DHS)
Changes made: Fully restore from backups
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 days(5 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 3 states

View merged incident ↗

Idaho State AGOct 19 · first · this page

Idaho State AG+87d

Montana State AG+94d

Massachusetts State AG+98d

Pattern: first filing Oct 19 (ID), last Jan 25 (MA) — a 98-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ag.idaho.gov/content/uploads/2022/03/10-19-21-Valley-Regional-Transit-VRT.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 19, 2021
Raw hash: 27b8fca7f5d9950f768b469b6348b59d5f2497afc3a749b98479e5497fc44f1d

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityECKERT SEAMANS CHERIN & MELLOTT, LLC

Victim entityValley Regional Transit

Incidentdiscovered Oct 14, 2021

Stated responseEngaged legal counsel with an expertise in cybersecurity

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceag.idaho.gov