HackingManufacturingIdentity (basic)Financial accountLowContained

Cintas Corporation

bd_8b29a0c56ea7f77b · schema v1 · pii pii-v1

Severity

Low

Discovered

Sep 20, 2020

Filed

Feb 18, 2021

To disclose

22 weeks

Affected

2state residents only

Linked

4 filings

Confidence

66%

Full breach record for Cintas Corporation →

Cintas Corporation notified the New Hampshire Attorney General of a security incident where unauthorized access to file servers occurred between September 16 and 20, 2020. The investigation determined that files containing names and financial account numbers of two New Hampshire residents were accessed. Cintas engaged a cybersecurity firm, notified law enforcement, and implemented enhanced network security measures.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 4 days

discovery → filing · 22 weeks / 151 days

Sep 16, 2020

Begins

Sep 20, 2020

Discovered

Feb 18, 2021

Filed

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Indiana State AGbd_10b336354022210d2021-02-15 · +3dVerified
Massachusetts State AGbd_a8d0e2bd2a6201862021-02-15 · +3dVerified
Montana State AGbd_ddf2740c17871b612021-02-15 · +3dCandidate

Name: Cintas Corporation
norm: cintas

Name: Cintas Corporation
norm: cintas

Discovered: Sep 20, 2020
Breach occurred: Sep 16, 2020 – Sep 20, 2020
Undetected for: 4 daysoccurrence → discovery
Materiality determined: —
Notification sent: Feb 15, 2021
Affected individuals: 2state-resident count only
Data types: Identity (basic)Financial account
Attack vector: Unauthorized Access
MITRE ATT&CK: T1119 Automated Collection
Threat actor: External

During the incident: A cybersecurity firm was engaged
Notified law enforcement
Changes made: Implemented additional security measures to further enhance the security of its network
Endpoint detection and response tool
New managed security service provider
Enhanced alerting and response capabilities
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 22 weeks(151 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Indiana State AGFeb 15 · first

Massachusetts State AGFeb 15 · first

Montana State AGFeb 15 · first

New Hampshire State AG+3d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/cintas-20210218.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 18, 2021
Raw hash: ea10c5664583485e11e6e85ed44ad877f86de7f10340f9c5fc9b3bc647975a9a

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityCintas Corporation

Victim entityCintas Corporation

Incidentdiscovered Sep 20, 2020

Stated responseA cybersecurity firm was engaged

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov