Social EngineeringPhishingCustomer Data InvolvedEmployee Data InvolvedIDENTITY_BASICIDENTITY_GOVERNMENTHEALTH_BASICMediumContained
Monro, Inc.
bd_81844f5cb8cb5b78 · schema v1 · pii pii-v1
Full breach record for Monro, Inc. →Monro, Inc. notified affected individuals in multiple states (including Delaware and Rhode Island) of a security incident in late 2024 involving unauthorized access to an employee's email account. The breach exposed names, Social Security numbers, dates of birth, and employee health/accident history. Approximately 975 Rhode Island residents were specifically identified. Monro offered 12 months of credit monitoring via Experian.
This filing is one of 7 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (6) · sorted by filing gap
- bd_3909ba1739d123c4Indiana State AGfiled 2025-03-21Verified
- bd_f9efcb8fd813b56cCalifornia State AGfiled 2025-03-21Verified
- bd_597f39e11b1b7606Maryland State AGfiled 2025-03-20(1d gap)Verified
- bd_688c27eeb1e682daNew Hampshire State AGfiled 2025-03-24(3d gap)Verified
Show 2 more filings ↓Show fewer ↑up to 4d gap
- bd_098cf4205b448a91Vermont State AGfiled 2025-03-25(4d gap)Verified
- bd_eea3ee925e08d5fdMaine State AGfiled 2025-03-25(4d gap)Candidate
Source provenance
- Source URL
- https://attorneygeneral.delaware.gov/wp-content/uploads/sites/50/2025/03/Redacted-Version-1.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Mar 21, 2025
- Raw hash
- 65cb3b5f9f6e81f06ecdec4af580efae26a5c4c71c9e16ca0191b506ea159445
Reporting entity
- Name
- Monro, Inc.norm: monro
Victim entity
- Name
- Monro, Inc.norm: monro
Incident
- Discovered
- Nov 1, 2024
- Materiality determined
- —
- Notification sent
- Mar 21, 2025
- Affected individuals
- 975
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENTHEALTH_BASIC
- Attack vector
- Phishing
- MITRE ATT&CK
- T1566.002 Spearphishing Link
- Threat actor
- External
- Initial access
- phishing_link
Compliance
- Time to disclose
- 20 weeks(140 days from discovery to filing)
- Compliance flags
- — (clock not assessable for this source)
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.