HackingData ExfiltratedEmployee Data InvolvedFinancial accountHealth (basic)Identity (basic)Government IDPHIMediumContained

AOTCO Metal Finishing, LLC

bd_935c72dfcf3d60ee · schema v1 · pii pii-v1

Severity

Medium

Discovered

Mar 27, 2026

Filed

May 7, 2026

To disclose

6 weeks

Affected

254state residents only

Linked

3 filings

Confidence

66%

AOTCO Metal Finishing, LLC disclosed a cybersecurity incident discovered on March 27, 2026, where a threat actor potentially accessed and exfiltrated employee files containing SSNs, driver's license numbers, payroll, and health insurance info. AOTCO engaged forensic investigators, disabled the network and VPN, forced password resets, and offered 24 months of Experian IdentityWorks. The notification was filed with Massachusetts authorities on May 6, 2026.

J jump to incidentP pin to compareR raw source

Massachusetts clock⏱ MA AG >30d6 weeks discovery → filing

Incident timeline

discovery → filing · 6 weeks / 41 days

Mar 27, 2026

Discovered

May 7, 2026

Filed

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Massachusetts State AGbd_8010a5b7e074cd922026-05-11 · +4dCandidate
New Hampshire State AGbd_98d7cf312131d8922026-05-12 · +5dVerified

Name: AOTCO Metal Finishing, LLC
norm: aotco metal finishing
Domain: aotco.com

Name: AOTCO Metal Finishing, LLC
norm: aotco metal finishing
Domain: aotco.com

Discovered: Mar 27, 2026
Materiality determined: —
Notification sent: May 6, 2026
Affected individuals: 254state-resident count only
Data types: Financial accountHealth (basic)Identity (basic)Government IDPHI
Data elements: Social Security number
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 Channel
Threat actor: External
Regulator citations: notified government authorities of the incident
Initial access: exploit_public_facing

During the incident: Engaged a third-party forensics firm to investigate the incident
Disabled the network
Notified government authorities of the incident
Secured the impacted network
Disabled the impacted VPN
Forced a password reset for employees
Implemented additional cyber awareness trainings and other security measures
Offering complimentary access to Experian IdentityWorks for 24 months
Changes made: Implemented additional cyber awareness trainings
Implemented other security measures
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 weeks(41 days from discovery to filing)
Compliance flags: MA AG >30d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 2 states

View merged incident ↗

Massachusetts State AGMay 7 · first · this page

Massachusetts State AG+4d

New Hampshire State AG+5d

Pattern: first filing May 7 (MA), last May 12 (NH) — a 5-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.mass.gov/doc/2026-718-aotco-metal-finishing-llc/download
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 7, 2026
Raw hash: f74110e82f3d685ac49311d0562a83da491b7f2d747f6e795678ca4b76c07a76

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityAOTCO Metal Finishing, LLC

Victim entityAOTCO Metal Finishing, LLC

Incidentdiscovered Mar 27, 2026

Stated responseEngaged a third-party forensics firm to investigate the incident

ComplianceMA AG >30d

Extraction provenanceno artifact recorded

Source provenancewww.mass.gov