MalwareRetail & ConsumerRetailRansomwareData ExfiltratedData EncryptedSupply Chain (3P Vendor)Customer Data InvolvedIdentity (basic)Financial accountFinancial credentialsMediumContained

STURM, RUGER & COMPANY, INC.

bd_9199d624bedf76d6 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Aug 2, 2022

Filed

Aug 18, 2022

To disclose

16 days

Affected

3,031state residents only

Linked

11 filings

Confidence

64%

Full breach record for STURM, RUGER & COMPANY, INC. →

Sturm, Ruger & Company, Inc. notified customers that its third-party vendor, Freestyle Solutions, experienced a data breach involving malware on the server hosting ShopRuger.com. The malware operated from September 18, 2020, to February 3, 2022, capturing customer payment card information, names, and addresses. Sturm Ruger engaged Verizon for investigation and offered identity theft protection services.

J jump to incidentP pin to compareR raw source

South Carolina clock✓ SC CRA notice due16 days discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 683 days

discovery → filing · 16 days

Sep 18, 2020

Begins

Aug 2, 2022

Discovered

Aug 18, 2022

Filed

vs. sector median

7 wks faster

This filing is one of 11 filings about the same incident.View merged incident

Part of FreeStyle Solutions supply-chain incident (2022) — a supply-chain cascade affecting multiple organizations.View cascade →

Linked disclosures

Why this link?

Regulatory filings (10) · sorted by filing gap

Massachusetts State AGbd_2756ba599a1cd56c2022-08-18Verified
Indiana State AGbd_4fae1ff48d4333632022-08-18Verified
Washington State AGbd_ab208d75cc9435ea2022-08-18Verified
New Hampshire State AGbd_424fddae629065202022-08-19 · +1dVerified

Show 6 more filings ↓up to 16d gap

Delaware State AGbd_1f4061fbb0cfdce22022-08-17 · +1dVerified
California State AGbd_38f04b97485bb4182022-08-17 · +1dCandidate
Maine State AGbd_9393cab4cdd552b62022-08-17 · +1dVerified
Oregon State AGbd_ebaf2f767137b90a2022-08-17 · +1dVerified
Montana State AGbd_f3f2fe6ea215d9fd2022-08-17 · +1dVerified by operator
Delaware State AGbd_33d8926df2b3726e2022-08-02 · +16dVerified

Name: STURM, RUGER & COMPANY, INC.
norm: sturm ruger

Name: STURM, RUGER & COMPANY, INC.
norm: sturm ruger
Industry: Retail & Consumerllm

Discovered: Aug 2, 2022
Breach occurred: Sep 18, 2020 – Feb 3, 2022
Undetected for: 683 daysoccurrence → discovery
Materiality determined: —
Notification sent: Aug 18, 2022
Affected individuals: 3,031state-resident count only
Data types: Identity (basic)Financial accountFinancial credentials
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Notified federal law enforcement authorities
Third party: via Freestyle Solutions
Initial access: supply_chain

During the incident: Engaged Verizon to conduct an investigation and advise on further containment and remediation activities
Notified federal law enforcement authorities of this data breach
Coordinating with payment card companies in an effort to protect affected cardholders
Offering identity theft protection services through IDX
Changes made: Removed malware from the server
Blocked known malicious users
Changed administrative passwords
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 16 days(16 days from discovery to filing)
Compliance flags: SC CRA notice due
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 11 filings · 10 states

View merged incident ↗

Delaware State AGAug 2 · first

Delaware State AG+15d

California State AG+15d

Maine State AG+15d

Oregon State AG+15d

Montana State AG+15d

Massachusetts State AG+16d

Indiana State AG+16d

Washington State AG+16d

South Carolina State AG+16d · this page

New Hampshire State AG+17d

Pattern: first filing Aug 2 (DE), last Aug 19 (NH) — a 17-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2022/SturmRuger%26CompanyInc..pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 18, 2022
Raw hash: 35cfe6950b4feb309da00b689422e40c6c97420b92038ebc5e161c6f66572251

Linked disclosures

Regulatory filings (10) · sorted by filing gap

Reporting entitySTURM, RUGER & COMPANY, INC.

Victim entitySTURM, RUGER & COMPANY, INC.

Incidentdiscovered Aug 2, 2022

Stated responseEngaged Verizon to conduct an investigation and advise on further containment and remediation activities

ComplianceSC CRA notice due

Extraction provenanceno artifact recorded

Source provenanceconsumer.sc.gov