MalwareRetail & ConsumerRetailRansomwareData EncryptedData ExfiltratedTargetedEducationFinancial accountHealth (basic)Identity (basic)Government IDPHIHighContained

Electric Mirror

bd_965efba062586c64 · schema v1 · pii pii-v1

Severity

High

Discovered

Mar 29, 2024

Filed

May 3, 2024

To disclose

5 weeks

Affected

1,313state residents only

Linked

7 filings

Confidence

70%

Full breach record for Electric Mirror →

Electric Mirror LLC, a retail business, reported a ransomware incident to the Washington Attorney General. Suspicious activity was detected on March 29, 2024, and unauthorized access encrypting data was confirmed on April 3, 2024. The breach affected 1,313 Washington residents, exposing PII, SSNs, financial account numbers, and health insurance data. The company engaged forensic investigators, restricted network access, and offered credit monitoring.

J jump to incidentP pin to compareR raw source

Washington clock⏱ WA AG >30d5 weeks discovery → filing

⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Incident timeline

discovery → filing · 5 weeks / 35 days

Mar 29, 2024

Begins

Mar 29, 2024

Discovered

May 3, 2024

Filed

vs. sector median

3 wks faster

This filing is one of 7 about the same incident.View merged incident

Linked disclosures

Why this link?

Ransomware claims (2)

Leak Siteinc_ransombd_e89c9bb7c3fe772b2024-05-08 · +6dVerified by operator
Leak Siteinc_ransombd_b9ddb6b005b2e3732024-05-06 · +3dVerified by operator

Regulatory filings (4) · sorted by filing gap

Massachusetts State AGbd_84ed94c7d9b0b7ed2024-05-03Verified by operator
Massachusetts State AGbd_98d12d6ae9571c1b2024-05-03Candidate
Indiana State AGbd_aa5f5cc12db1d64b2024-05-03Verified
Idaho State AGbd_ffa166456bd32fba2024-05-10 · +7dVerified by operator

Name: Wilson, Elser, Moskowitz, Edelman & Dicker LLP
norm: wilson elser moskowitz edelman dicker
Domain: wilsonelser.com

Name: Electric Mirror
norm: electric mirror
Domain: electricmirror.com
Industry: Retail & Consumerllm

Discovered: Mar 29, 2024
Breach occurred: Mar 29, 2024 – Apr 3, 2024
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: May 3, 2024
Affected individuals: 1,313state-resident count only
Data types: Identity (basic)Government IDFinancial accountHealth (basic)
Data elements: NameSocial Security numberFinancial account numberDate of birthStudent ID numberMilitary ID numberPassport numberHealth insurance ID
WA-stated cause: Cyberattack
WA-stated duration: lifecycle 1-99dexposure 1-99d
WA-stated discovery: Found while ongoing
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Notified Washington Attorney General Bob Ferguson

During the incident: Engaged a specialized third-party cybersecurity firm and IT personnel to assist with securing and strengthening the environment
Restricted access to the network
Conducted a forensic investigation
Changed administrative credentials
Restored operations in a safe and secure mode
Enhanced security measures
Offered free credit monitoring and identity theft protection through Cyberscout
Changes made: Enhanced security measures
Changed administrative credentials
Restricted access to the network
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 weeks(35 days from discovery to filing)
Compliance flags: WA AG >30d
Discovery-date grounding: occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 4 states

View merged incident ↗

Massachusetts State AGMay 3 · first

Indiana State AGMay 3 · first

Washington State AGMay 3 · first · this page

Idaho State AG+7d

Pattern: first filing May 3 (MA), last May 10 (ID) — a 7-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA29015.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 3, 2024
Raw hash: b01797174078b9f21b2b6480edb94cf5242032f9cb4aedc37144198cab2b694f

Linked disclosures

Ransomware claims (2)

Regulatory filings (4) · sorted by filing gap

Reporting entityWilson, Elser, Moskowitz, Edelman & Dicker LLP

Victim entityElectric Mirror

Incidentdiscovered Mar 29, 2024

Stated responseEngaged a specialized third-party cybersecurity firm and IT personnel to assist with securing and strengthening the environment

ComplianceWA AG >30d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com