MalwareRetail & ConsumerRetailRansomwareData ExfiltratedData EncryptedSupply Chain (3P Vendor)Customer Data InvolvedIdentity (basic)Financial accountFinancial credentialsMediumContained

STURM, RUGER & COMPANY, INC.

bd_9199d624bedf76d6 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Aug 2, 2022

Filed

Aug 18, 2022

To disclose

16 days

Affected

3,031state residents only

Confidence

64%

Full breach record for STURM, RUGER & COMPANY, INC. →3 incidents on file

Sturm, Ruger & Company, Inc. notified customers that its third-party vendor, Freestyle Solutions, experienced a data breach involving malware on the server hosting ShopRuger.com. The malware operated from September 18, 2020, to February 3, 2022, capturing customer payment card information, names, and addresses. Sturm Ruger engaged Verizon for investigation and offered identity theft protection services.

J jump to incidentP pin to compareR raw source

South Carolina clock✓ SC CRA notice due16 days discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 683 days

discovery → filing · 16 days

Sep 18, 2020

Begins

Aug 2, 2022

Discovered

Aug 18, 2022

Filed

vs. sector median

5 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed3,031 affectedView incident

Name: STURM, RUGER & COMPANY, INC.
norm: sturm ruger

Name: STURM, RUGER & COMPANY, INC.
norm: sturm ruger
Industry: Retail & Consumerllm

Discovered: Aug 2, 2022
Breach occurred: Sep 18, 2020 – Feb 3, 2022
Undetected for: 683 daysoccurrence → discovery
Materiality determined: —
Notification sent: Aug 18, 2022
Affected individuals: 3,031state-resident count only
Data types: Identity (basic)Financial accountFinancial credentials
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Notified federal law enforcement authorities
Third party: via Freestyle Solutions
Initial access: supply_chain

During the incident: Engaged Verizon to conduct an investigation and advise on further containment and remediation activities
Notified federal law enforcement authorities of this data breach
Coordinating with payment card companies in an effort to protect affected cardholders
Offering identity theft protection services through IDX
Changes made: Removed malware from the server
Blocked known malicious users
Changed administrative passwords
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 16 days(16 days from discovery to filing)
Compliance flags: SC CRA notice due
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2022/SturmRuger%26CompanyInc..pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 18, 2022
Raw hash: 35cfe6950b4feb309da00b689422e40c6c97420b92038ebc5e161c6f66572251

Reporting entitySTURM, RUGER & COMPANY, INC.

Victim entitySTURM, RUGER & COMPANY, INC.

Incidentdiscovered Aug 2, 2022

Stated responseEngaged Verizon to conduct an investigation and advise on further containment and remediation activities

ComplianceSC CRA notice due

Extraction provenanceno artifact recorded

Source provenanceconsumer.sc.gov