HackingData ExfiltratedCustomer Data InvolvedIDENTITY_BASICFINANCIAL_ACCOUNTMediumContained
ACUITY BRANDS LIGHTING, INC.
bd_8343b9543b9f0798 · schema v1 · pii pii-v1
Full breach record for ACUITY BRANDS LIGHTING, INC. →Acuity Brands, Inc. reported an external system breach (hacking) occurring between October 6, 2020, and December 8, 2021, discovered on December 7, 2021. The incident compromised names and financial account numbers (including credit/debit card numbers with security codes/PINs) for 37,137 individuals, including 22 Maine residents. Notification was sent on December 6, 2022, offering 12 months of identity protection services via Experian.
Maine clockDiscovered Dec 7, 2021 → Filed with AG Dec 6, 2022364d ✗ ME AG >90d52 weeks discovery → filing
⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
This filing is one of 4 about the same incident.View merged incident
A leak claim by conti about this victim predates this filing by 325 days.View originating leak claim
Linked disclosures
Why this link?Ransomware claims (1)
- bd_0808452fec3877d5Leak Sitecontifiled 2022-01-15(325d gap)Verified by operator
Regulatory filings (2) · sorted by filing gap
- bd_9f481a0a57a510beCalifornia State AGfiled 2022-12-06Verified
- bd_e48270b605e5e4d5Montana State AGfiled 2022-12-06Verified by operator
Source provenance
- Source URL
- https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/1af8a682-861a-4e94-a005-d50740ab143f.shtml
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Dec 6, 2022
- Raw hash
- 4f1ec365831db0594fc1b9d983424f7605dcb7a423d6afaf36e2f9af08fc20b0
Reporting entity
- Name
- ACUITY BRANDS LIGHTING, INC.norm: acuity brands lighting
Victim entity
- Name
- ACUITY BRANDS LIGHTING, INC.norm: acuity brands lighting
Incident
- Discovered
- Dec 7, 2021
- Materiality determined
- —
- Notification sent
- Dec 6, 2022
- Affected individuals
- 37,137
- Data types
- IDENTITY_BASICFINANCIAL_ACCOUNT
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1190 Exploit Public-Facing Application
- Threat actor
- ExternalFinancial
- Regulator citations
- Filed data breach notice with Maine Attorney General
- Initial access
- exploit_public_facing
Compliance
- Time to disclose
- 52 weeks(364 days from discovery to filing)
- Compliance flags
- ME AG >90d · 364dME resident >180d · 364dLeak >180d
- Discovery-date grounding
- unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
- Clock breakdown
Statute Window Elapsed Threshold Status Maine Discovered: Dec 7, 2021→ Filed with AG: Dec 6, 2022364d 90 days ME AG >90d Maine Discovered: Dec 7, 2021→ Notified: Dec 6, 2022364d 180 days ME resident >180d
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.