MalwareHospitalityHospitalityRansomwareData EncryptedCustomer Data InvolvedPIILowContained

Ski Bromley, LLC

bd_791dcb1f4472494a · schema v1 · pii pii-v1

Severity

Low

Discovered

Jun 28, 2021

Filed

Aug 5, 2021

To disclose

5 weeks

Affected

1state residents only

Confidence

65%

Full breach record for Ski Bromley, LLC →

Ski Bromley, LLC (d/b/a Bromley Mountain Ski Resort) disclosed a ransomware attack discovered on June 28, 2021. The attack resulted in encryption and unauthorized access to the network. The company contained the threat, conducted a forensic investigation, and confirmed deletion of exfiltrated data. A comprehensive review concluded on July 29, 2021, that some individuals' personal information may have been involved. The company engaged external legal and cybersecurity experts and is implementing additional safeguards, including employee training and procedure improvements.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 5 weeks / 38 days

Jun 28, 2021

Discovered

Aug 5, 2021

Filed

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed1 affectedView incident

Name: SKI
norm: ski
Domain: skimag.com

Name: Ski Bromley, LLC
norm: ski bromley
Industry: Hospitalityllm

Discovered: Jun 28, 2021
Materiality determined: —
Notification sent: Jul 29, 2021
Affected individuals: 1state-resident count only
Data types: PII
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for Impact
Threat actor: ExternalFinancial

During the incident: Took immediate steps to stop the threat and understand the situation's full scope
Concluded initial forensic investigation
Retrieved and confirmed the deletion of the information obtained by the unauthorized individual
Concluded comprehensive review of the potentially impacted data
Engaging external legal and cybersecurity experts to assist in this process
Changes made: Further training our employees
Reviewing and improving our internal procedures as necessary to minimize the likelihood of this type of incident occurring again
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 weeks(38 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2021/SkiBromley.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 5, 2021
Raw hash: 8155f1ebed0c3355f117c05be4d44e833e3fff92536b74d3d6a073a0103bf350

Reporting entitySKI

Victim entitySki Bromley, LLC

Incidentdiscovered Jun 28, 2021

Stated responseTook immediate steps to stop the threat and understand the situation's full scope

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceconsumer.sc.gov