MalwareRetail & ConsumerRetailRansomwareData EncryptedTargetedPIIIdentity (basic)LowContained

Stephen Gould Corporation

bd_9b310b62ef34ae48 · schema v1 · pii pii-v1

Severity

Low

Discovered

Sep 19, 2020

Filed

May 18, 2021

To disclose

34 weeks

Affected

1state residents only

Linked

5 filings

Confidence

67%

Full breach record for Stephen Gould Corporation →

Stephen Gould Corporation notified individuals of a malware incident discovered on September 19, 2020. Unauthorized actors viewed or took personal information. The company notified federal law enforcement, improved network security policies, and provided 12 months of free identity monitoring via Kroll. The investigation confirmed the scope of impacted data by April 12, 2021.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 34 weeks / 241 days

Sep 19, 2020

Discovered

May 18, 2021

Filed

vs. sector median

+27 wks slower

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Maine State AGbd_71dfa7ccfde5de6b2021-05-18Candidate
Indiana State AGbd_8d128ee889edfa3c2021-05-18Verified
Massachusetts State AGbd_ea58616d974a8e1a2021-05-18Verified
New Hampshire State AGbd_50dfd587c641aa6c2021-05-24 · +6dVerified

Name: Stephen Gould Corporation
norm: stephen gould

Name: Stephen Gould Corporation
norm: stephen gould
Industry: Retail & Consumerllm

Discovered: Sep 19, 2020
Materiality determined: —
Notification sent: —
Affected individuals: 1state-resident count only
Data types: PIIIdentity (basic)
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for Impact
Threat actor: ExternalFinancial
Regulator citations: notifed federal law enforcement

During the incident: Moved quickly to investigate and respond to this incident
Assess the security of our systems
Restore functionality to the environment
Notifed federal law enforcement
Signifcantly improved and augmented our policies and procedures addressing our network security
Offering you access to 12 months of free identity monitoring services through Kroll
Changes made: Signifcantly improved and augmented our policies and procedures addressing our network security
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 34 weeks(241 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Maine State AGMay 18 · first

Indiana State AGMay 18 · first

Massachusetts State AGMay 18 · first

Montana State AGMay 18 · first · this page

New Hampshire State AG+6d

Pattern: first filing May 18 (ME), last May 24 (NH) — a 6-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/scg-notif.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 18, 2021
Raw hash: 10bbcfc3dc2d0baa4389aaccd31f17448cb7803ec4d10e4930b2fb6f80131d92

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityStephen Gould Corporation

Victim entityStephen Gould Corporation

Incidentdiscovered Sep 19, 2020

Stated responseMoved quickly to investigate and respond to this incident

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov