HackingTechnologyInformationData ExfiltratedCustomer Data InvolvedIdentity (basic)Financial accountMediumContained

ACUITY BRANDS LIGHTING, INC.

bd_8343b9543b9f0798 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Dec 7, 2021

Filed

Dec 6, 2022

To disclose

52 weeks

Affected · nationwide

37,13722 in this filing

Linked

6 filings

Confidence

66%

Full breach record for ACUITY BRANDS LIGHTING, INC. →

Acuity Brands, Inc. reported an external system breach (hacking) occurring between October 6, 2020, and December 8, 2021, discovered on December 7, 2021. The incident compromised names and financial account numbers (including credit/debit card numbers with security codes/PINs) for 37,137 individuals, including 22 Maine residents. Notification was sent on December 6, 2022, offering 12 months of identity protection services via Experian.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Dec 7, 2021 → Filed with AG Dec 6, 2022364d ✗ ME AG >90d52 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 427 days

discovery → filing · 52 weeks / 364 days

Oct 6, 2020

Begins

Dec 7, 2021

Discovered

Dec 6, 2022

Filed

vs. sector median

+33 wks slower

This filing is one of 6 about the same incident.View merged incident

A leak claim by conti about this victim predates this filing by 325 days.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Sitecontibd_0808452fec3877d52022-01-15 · +325dVerified by operator

Regulatory filings (4) · sorted by filing gap

Indiana State AGbd_13f8e899096057462022-12-06Verified by operator
Massachusetts State AGbd_7aa653c6745570012022-12-06Verified by operator
California State AGbd_9f481a0a57a510be2022-12-06Verified
Montana State AGbd_e48270b605e5e4d52022-12-06Verified

Name: ACUITY BRANDS LIGHTING, INC.
norm: acuity brands lighting

Name: ACUITY BRANDS LIGHTING, INC.
norm: acuity brands lighting
Industry: Technologyllm

Discovered: Dec 7, 2021
Breach occurred: Oct 6, 2020 – Dec 8, 2021
Undetected for: 427 daysoccurrence → discovery
Materiality determined: —
Notification sent: Dec 6, 2022
Affected individuals: 37,137state + nationwide
Data types: Identity (basic)Financial account
Data elements: Financial account number
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: ExternalFinancial
Regulator citations: Filed data breach notice with Maine Attorney General
Initial access: exploit_public_facing

During the incident: Sent written notification to affected consumers
Offered 12 months of identity theft protection services through Experian
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 52 weeks(364 days from discovery to filing)
Compliance flags: ME AG >90d · 364dME resident >180d · 364dLeak >180d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Dec 7, 2021
→ Filed with AG: Dec 6, 2022
364d 90 days ME AG >90d
Maine
Discovered: Dec 7, 2021
→ Notified: Dec 6, 2022
364d 180 days ME resident >180d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Dec 7, 2021 → Filed with AG: Dec 6, 2022	364d	90 days	ME AG >90d
Maine	Discovered: Dec 7, 2021 → Notified: Dec 6, 2022	364d	180 days	ME resident >180d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Indiana State AGDec 6 · first

Massachusetts State AGDec 6 · first

California State AGDec 6 · first

Montana State AGDec 6 · first

Maine State AGDec 6 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/1af8a682-861a-4e94-a005-d50740ab143f.shtml
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 6, 2022
Raw hash: 4f1ec365831db0594fc1b9d983424f7605dcb7a423d6afaf36e2f9af08fc20b0

Linked disclosures

Ransomware claims (1)

Regulatory filings (4) · sorted by filing gap

Reporting entityACUITY BRANDS LIGHTING, INC.

Victim entityACUITY BRANDS LIGHTING, INC.

Incidentdiscovered Dec 7, 2021

Stated responseSent written notification to affected consumers

ComplianceME AG >90d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov