HackingManufacturingManufacturingStolen CredentialsData ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDFinancial accountMediumContained

A Y McDonald Industries Inc

bd_7c60d53c920479ad · schema v1 · pii pii-v2

Severity

Medium

Discovered

Sep 19, 2025

Filed

Oct 21, 2025

To disclose

—

Affected

Not disclosed

Linked

4 filings

Confidence

65%

Full breach record for A Y McDonald Industries Inc →3 incidents on file

A.Y. McDonald Industries, Inc. notified affected individuals of a security incident occurring on or about January 12, 2025. Unauthorized access to files containing personal information (names, SSNs, credit card numbers) was discovered on September 19, 2025. The company engaged external cybersecurity professionals and federal law enforcement, and offered 12 months of credit monitoring via Experian IdentityWorks. The notification was dated October 21, 2025.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 250 days

Jan 12, 2025

Begins

Sep 19, 2025

Discovered

Oct 21, 2025

Filed

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Indiana State AGbd_81c38ef1721525ae2025-10-21Candidate
New Hampshire State AGbd_aaa7f816df5c824d2025-10-21Verified
Massachusetts State AGbd_efaa43e3ad6e5bd82025-10-21Verified

Name: A Y McDonald Industries Inc
norm: a y mcdonald

Name: A Y McDonald Industries Inc
norm: a y mcdonald
Industry: Manufacturingllm

Discovered: Sep 19, 2025
Breach occurred: Jan 12, 2025
Undetected for: 250 daysoccurrence → discovery
Materiality determined: —
Notification sent: Oct 21, 2025
Affected individuals: Not disclosed
Data types: Identity (basic)Government IDFinancial account
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: notified federal law enforcement
Initial access: valid_credentials

During the incident: Worked closely with external cybersecurity professionals
Notified federal law enforcement of the incident
Reviewing our existing policies and training protocols relating to data protection
Enhancing security measures and monitoring tools
Conducted a manual review of the impacted files
Providing you with complimentary access to Experian IdentityWorksSM for 12 months
Changes made: Reviewing our existing policies and training protocols relating to data protection
Enhancing security measures and monitoring tools
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Indiana State AGOct 21 · first

New Hampshire State AGOct 21 · first

Massachusetts State AGOct 21 · first

Nebraska State AGOct 21 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://nebraska.gov/ago/data-breach/documents/90df81c8-ec6b-488d-9293-fd63fb514eef.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 21, 2025
Raw hash: 56c9d79b7d21386eb916648ec6a53c60e6b4342de36c004db10a4fbdfd87e8b8

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityA Y McDonald Industries Inc

Victim entityA Y McDonald Industries Inc

Incidentdiscovered Sep 19, 2025

Stated responseWorked closely with external cybersecurity professionals

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancenebraska.gov