HackingTransportation & LogisticsTransportationBrute ForceStolen CredentialsCapture Stored DataTargetedData ExfiltratedIdentity (basic)Government IDFinancial accountHealth (basic)MediumContained

Bruckner's Truck & Equipment

bd_9057810182689b69 · schema v1 · pii pii-v1

Severity

Medium

Discovered

May 21, 2025

Filed

Jul 9, 2025

To disclose

7 weeks

Affected

30state residents only

Linked

5 filings

Confidence

66%

Full breach record for Bruckner's Truck & Equipment →3 incidents on file

Bruckner's Truck & Equipment experienced a data breach on May 20, 2025, where a bad actor used a brute force attack on a VPN account to access an employee database. The incident was detected on May 21, 2025, and access was eliminated the same day. Compromised data included names, SSNs, government IDs, and health insurance info. The company engaged forensic experts, notified law enforcement, and offered one year of LifeLock identity theft protection to affected individuals.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 1 days

discovery → filing · 7 weeks / 49 days

May 20, 2025

Begins

May 21, 2025

Discovered

Jul 9, 2025

Filed

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Siteqilinbd_1fb4a91487a2a56b2025-05-20 · +50dVerified by operator

Regulatory filings (3) · sorted by filing gap

Maine State AGbd_c7c5ad07436130662025-07-09Verified
Indiana State AGbd_8104f2a79be4c91a2025-07-11 · +2dVerified
Texas State AGbd_ca255e609b4a85a62025-07-18 · +9dVerified

Name: Bruckner's Truck & Equipment
norm: bruckner s truck equipment
Domain: brucknertruck.com

Name: Bruckner's Truck & Equipment
norm: bruckner s truck equipment
Domain: brucknertruck.com
Industry: Transportation & Logisticsllm

Discovered: May 21, 2025
Breach occurred: May 20, 2025
Undetected for: 1 dayoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 30state-resident count only
Data types: Identity (basic)Government IDFinancial accountHealth (basic)
Data elements: Social Security number
Attack vector: Unauthorized Access
MITRE ATT&CK: T1110 Brute ForceT1078 Valid AccountsT1119 Automated Collection
Threat actor: ExternalFinancial
Regulator citations: Notified law enforcement
Initial access: valid_credentials

During the incident: Engaged cybersecurity experts to ensure threat was neutralized
Notified law enforcement
Partnered with LifeLock to provide one year of free protection against credit and identity theft monitoring
Changes made: Rebuilt information security infrastructure
Migrated all electronic data to a cloud-based system
Changed the way data of current and former employees is stored, adding new security safeguards
Migrated all employee access to systems to a program requiring heightened password complexity and two-factor identification
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 7 weeks(49 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Maine State AGJul 9 · first

Montana State AGJul 9 · first · this page

Indiana State AG+2d

Texas State AG+9d

Pattern: first filing Jul 9 (ME), last Jul 18 (TX) — a 9-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/2025/07/Consumer-notification-letter.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 9, 2025
Raw hash: 3113843aa3b5141e9322f50a1d07a61dc891042a06236c39f168b5f3e3a52ddd

Linked disclosures

Ransomware claims (1)

Regulatory filings (3) · sorted by filing gap

Reporting entityBruckner's Truck & Equipment

Victim entityBruckner's Truck & Equipment

Incidentdiscovered May 21, 2025

Stated responseEngaged cybersecurity experts to ensure threat was neutralized

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov