HackingTransportation & LogisticsTransportationCustomer Data InvolvedDelayed DiscoveryIdentity (basic)Government IDHighContained

Brown Integrated Logistics

bd_8bf6b563b1b0d494 · schema v1 · pii pii-v1

Severity

High

Discovered

Aug 27, 2024

Filed

Sep 23, 2024

To disclose

27 days

Affected · nationwide

9,7121 in this filing

Linked

4 filings

Confidence

65%

Full breach record for Brown Integrated Logistics →

Brown Integrated Logistics, Inc. reported an external system breach (hacking) occurring between Nov 13-15, 2023. Discovered Aug 27, 2024, after investigation confirmed unauthorized access. Potentially accessible data included names, addresses, and SSNs. 9,712 individuals affected (1 in Maine). Notifications sent Sept 23, 2024, including 12 months of Equifax credit monitoring.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Aug 27, 2024 → Filed with AG Sep 23, 202427d ✓ ME AG ≤30d27 days discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 288 days

discovery → filing · 27 days

Nov 13, 2023

Begins

Aug 27, 2024

Discovered

Sep 23, 2024

Filed

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Montana State AGbd_6a6bf5a35bbfe42d2024-09-23Candidate
Massachusetts State AGbd_c8fac34635737ba12024-09-23Verified
Indiana State AGbd_e1e9823e40cc51762024-09-23Verified

Name: Brown Integrated Logistics
norm: brown integrated logistics
Domain: brownintegratedlogistics.com

Name: Brown Integrated Logistics
norm: brown integrated logistics
Domain: brownintegratedlogistics.com
Industry: Transportation & Logisticsllm

Discovered: Aug 27, 2024
Breach occurred: Nov 13, 2023 – Nov 15, 2023
Undetected for: 288 daysoccurrence → discovery
Materiality determined: —
Notification sent: Sep 23, 2024
Affected individuals: 9,712state + nationwide
Data types: Identity (basic)Government ID
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1078 Valid Accounts
Threat actor: External
Regulator citations: Provided written notice to relevant state regulatorsNotified the three major credit reporting agencies, Equifax, Experian, and TransUnion
Initial access: exploit_public_facing

During the incident: Launched an investigation with the assistance of third-party cybersecurity specialists
Conducted a comprehensive, programmatic and manual review to determine what information was accessible
Worked to validate the results and locate missing address information
Mailed written notice to potentially impacted individuals
Provided access to credit monitoring services for twelve (12) months through Equifax
Provided impacted individuals with guidance on how to better protect against identity theft and fraud
Provided written notice to relevant state regulators and the three major credit reporting agencies
Changes made: Implemented additional technical safeguards
Provided additional training to its employees
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 27 days(27 days from discovery to filing)
Compliance flags: ME AG ≤30d · 27d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Aug 27, 2024
→ Filed with AG: Sep 23, 2024
27d 30 days ME AG ≤30d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Aug 27, 2024 → Filed with AG: Sep 23, 2024	27d	30 days	ME AG ≤30d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Montana State AGSep 23 · first

Massachusetts State AGSep 23 · first

Indiana State AGSep 23 · first

Maine State AGSep 23 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/bebd72cf-3825-4692-b29d-5fe6a30334a6.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 23, 2024
Raw hash: 776c6357d261f19247e5432f4fe8d4a349550e964680b227e65fad592eb4a431

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityBrown Integrated Logistics

Victim entityBrown Integrated Logistics

Incidentdiscovered Aug 27, 2024

Stated responseLaunched an investigation with the assistance of third-party cybersecurity specialists

ComplianceME AG ≤30d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov