HackingManufacturingCustomer Data InvolvedIdentity (basic)Government IDHigh

Simpson Strong-Tie

bd_93a5b96dd2b5cdf3 · schema v1 · pii pii-v1

Severity

High

Discovered

Oct 10, 2023

Filed

Mar 21, 2024

To disclose

23 weeks

Affected · nationwide

5,5702 in this filing

Linked

6 filings

Confidence

50%

Full breach record for Simpson Strong-Tie →

Simpson Strong-Tie Co. Inc. experienced an external system breach on October 9, 2023, which was discovered the following day. The breach compromised the names and Social Security numbers of 2 Maine residents. The company provided written notification to those affected on March 19, 2024, and offered two years of complimentary credit and identity monitoring services through Experian.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Oct 10, 2023 → Filed with AG Mar 21, 2024163d ✗ ME AG >90d23 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 1 days

discovery → filing · 23 weeks / 163 days

Oct 9, 2023

Begins

Oct 10, 2023

Discovered

Mar 21, 2024

Filed

This filing is one of 6 about the same incident.View merged incident

A leak claim by black_basta about this victim predates this filing by 163 days.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (2)

Leak Siteblack_bastabd_7db4a65669e33ced2023-11-01 · +140dVerified by operator
Leak Siteblack_bastabd_9328fe78dbf8d5792023-10-10 · +163dVerified by operator

Regulatory filings (3) · sorted by filing gap

California State AGbd_e9b36fbacf8cf7512024-03-21Verified by operator
Massachusetts State AGbd_e98ba9a53f8bd87a2024-03-23 · +2dVerified by operator
Indiana State AGbd_2c6394bc161722182024-03-19 · +2dVerified

Name: Simpson Strong-Tie
norm: simpson strong tie
Domain: strongtie.com

Name: Simpson Strong-Tie
norm: simpson strong tie
Domain: strongtie.com

Discovered: Oct 10, 2023
Breach occurred: Oct 9, 2023
Undetected for: 1 dayoccurrence → discovery
Materiality determined: —
Notification sent: Mar 19, 2024
Affected individuals: 5,570state + nationwide
Data types: Identity (basic)Government ID
Data elements: Social Security number
Attack vector: Unauthorized Access
Threat actor: External

Changes made: Offered 24 months of complimentary credit and identity monitoring services through Experian.
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 23 weeks(163 days from discovery to filing)
Compliance flags: ME AG >90d · 163dME resident >60d · 161dLeak >90d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Oct 10, 2023
→ Filed with AG: Mar 21, 2024
163d 90 days ME AG >90d
Maine
Discovered: Oct 10, 2023
→ Notified: Mar 19, 2024
161d 60 days (analyst band; statutory cap is 30 days) ME resident >60d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Oct 10, 2023 → Filed with AG: Mar 21, 2024	163d	90 days	ME AG >90d
Maine	Discovered: Oct 10, 2023 → Notified: Mar 19, 2024	161d	60 days (analyst band; statutory cap is 30 days)	ME resident >60d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Indiana State AGMar 19 · first

California State AG+2d

Maine State AG+2d · this page

Massachusetts State AG+4d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/6ccf4d5a-8550-4c04-9e8f-e3ae76aaaa4a.shtml
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 21, 2024
Raw hash: 7768c4833516b42ad88874abfe7acace8bb0f8ebf8b107479df689673f8f5599

Linked disclosures

Ransomware claims (2)

Regulatory filings (3) · sorted by filing gap

Reporting entitySimpson Strong-Tie

Victim entitySimpson Strong-Tie

Incidentdiscovered Oct 10, 2023

Stated responseOffered 24 months of complimentary credit and identity monitoring services through Experian.

ComplianceME AG >90d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov