HackingEnergy & UtilitiesUtilitiesStolen CredentialsCustomer Data InvolvedIdentity (basic)Government IDFinancial accountHealth (basic)MediumContained

Romeo Power, Inc.

bd_7f967ed8c5615413 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Oct 26, 2021

Filed

Feb 1, 2022

To disclose

14 weeks

Affected

Not disclosed

Confidence

65%

Full breach record for Romeo Power, Inc. →

Romeo Power, Inc. notified California residents that an unauthorized individual accessed an employee's email account between October 21 and October 27, 2021. The company observed suspicious activity on October 26, 2021. Affected data may include names, Social Security numbers, driver's license numbers, passport numbers, financial account numbers, and medical information. The company engaged a cybersecurity firm, secured the email environment, and is offering one year of identity theft protection services.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 5 days

discovery → filing · 14 weeks / 98 days

Oct 21, 2021

Begins

Oct 26, 2021

Discovered

Feb 1, 2022

Filed

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: ROMEO
norm: romeo
Domain: romeo.com

Name: Romeo Power, Inc.
norm: romeo power
Industry: Energy & Utilitiesllm

Discovered: Oct 26, 2021
Breach occurred: Oct 21, 2021 – Oct 27, 2021
Undetected for: 5 daysoccurrence → discovery
Materiality determined: —
Notification sent: Feb 1, 2022
Affected individuals: Not disclosed
Data types: Identity (basic)Government IDFinancial accountHealth (basic)
Data elements: Social Security numberMedical information
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1114 Email Collection
Threat actor: External
Initial access: valid_credentials

During the incident: Took steps to secure our email environment
Began an investigation
Engaged a cybersecurity firm to assist
Conducted a review of the contents of the email account to identify any individuals whose personal information may have been contained within the emails and attachments
Changes made: Implementation of additional security safeguards and controls in our network infrastructure
Offering a complimentary one-year membership in identity theft protection services through IDX
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 14 weeks(98 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-550603
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 1, 2022
Raw hash: 0547ed6196933437293fdaa2485ecff465188030e09d29892b09a58ecbb11032

Reporting entityROMEO

Victim entityRomeo Power, Inc.

Incidentdiscovered Oct 26, 2021

Stated responseTook steps to secure our email environment

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov