MalwareIdentity (basic)Government IDMediumContained

McCray Lumber

bd_883ffc0cd7c6b65b · schema v1 · pii pii-v2

Severity

Medium

Discovered

Dec 14, 2024

Filed

Jan 27, 2025

To disclose

—

Affected

Not disclosed

Linked

2 filings

Confidence

66%

Full breach record for McCray Lumber →

McCray Lumber Company notified Nebraska employees of a cybersecurity attack detected on December 14, 2024. An unauthorized third party attempted to infiltrate the network and demand a ransom. Potential exposure of names, DOB, driver's license, and SSN was noted. McCray secured the network, engaged forensic investigators, enhanced security measures, and offered 12 months of identity theft protection via IDX.

J jump to incidentP pin to compareR raw source

Leak gap clock⏱ Leak >30d

Incident timeline

Dec 14, 2024

Begins

Dec 14, 2024

Discovered

Jan 27, 2025

Filed

This filing is one of 2 about the same incident.View merged incident

A leak claim by play about this victim predates this filing by 52 days.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Siteplaybd_7ab2e904dee38fa02024-12-06 · +52dCandidate

Name: McCray Lumber
norm: mccray lumber
Domain: mccraylumber.com

Name: McCray Lumber
norm: mccray lumber
Domain: mccraylumber.com

Discovered: Dec 14, 2024
Breach occurred: Dec 14, 2024
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jan 27, 2025
Affected individuals: Not disclosed
Data types: Identity (basic)Government ID
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1189 Drive-by Compromise
Threat actor: ExternalFinancial
Initial access: drive_by_compromise

During the incident: Moved quickly to secure its network environment
Launched a thorough investigation
Performed investigation with the help of independent IT security and forensic investigators
Reviewed its policies and procedures relating to the security of its systems and information life cycle management
Enhanced its network security measures
Offered identity theft protection services through IDX
Changes made: Reviewed its policies and procedures relating to the security of its systems and information life cycle management
Enhanced its network security measures
Source: Quoted from the filing itself, not independently verified.

Compliance flags: Leak >30d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://nebraska.gov/ago/data-breach/documents/McCray - Sample Notification Letter.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 27, 2025
Raw hash: bfa270741a8770f34ffca9b8e9946a1028d48c9b1bef5e7a909dee08ae3d0b8e

Linked disclosures

Ransomware claims (1)

Reporting entityMcCray Lumber

Victim entityMcCray Lumber

Incidentdiscovered Dec 14, 2024

Stated responseMoved quickly to secure its network environment

ComplianceLeak >30d

Extraction provenanceno artifact recorded

Source provenancenebraska.gov