MalwareEnergy & UtilitiesUtilitiesRansomwareData EncryptedDelayed DiscoveryIdentity (basic)LowContained

American Trading and Production Corporation

bd_9e3ee27bb58aba0a · schema v1 · pii pii-v1

Severity

Low

Discovered

May 4, 2022

Filed

Nov 10, 2023

To disclose

19 months

Affected

Not disclosed

Linked

3 filings

Confidence

66%

Full breach record for American Trading and Production Corporation →2 incidents on file

American Trading and Production Corporation (ATAPCO) notified consumers of a data breach where an unauthorized actor accessed systems between Feb 17 and May 5, 2022. The incident involved malware infection preventing file access. Impacted data included names and potentially other PII. ATAPCO engaged forensic specialists, reported to law enforcement, and offered 24 months of credit monitoring. The incident was discovered in May 2022.

J jump to incidentP pin to compareR raw source

Vermont clock✗ VT AG >45 bday19 months discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 76 days

discovery → filing · 19 months / 555 days

Feb 17, 2022

Begins

May 4, 2022

Discovered

Nov 10, 2023

Filed

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

New Hampshire State AGbd_0e360421d505eb312023-11-10Verified
Maine State AGbd_169dcde121c93eda2023-11-10Candidate

Name: American Trading and Production Corporation
norm: american trading and production

Name: American Trading and Production Corporation
norm: american trading and production
Industry: Energy & Utilitiesllm

Discovered: May 4, 2022
Breach occurred: Feb 17, 2022 – May 5, 2022
Undetected for: 76 daysoccurrence → discovery
Materiality determined: —
Notification sent: Nov 10, 2023
Affected individuals: Not disclosed
Data types: Identity (basic)
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Notifying state regulators, as necessary
Initial access: valid_credentials

During the incident: Launched an investigation
Worked with third-party forensic specialists to investigate the nature and scope of the activity
Undertook a comprehensive and time-intensive review of the involved files with the assistance of third-party data review specialists
Conducted additional manual review of our internal files to confirm the identities of impacted individuals
Reported the incident to law enforcement
Offering twenty-four (24) months of complimentary access to credit monitoring services through Equifax
Changes made: Implementing additional technical security measures to strengthen the security of our systems
Reviewing and enhancing our existing data privacy policies and procedures
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 19 months(555 days from discovery to filing)
Compliance flags: VT AG >45 bday
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

New Hampshire State AGNov 10 · first

Maine State AGNov 10 · first

Vermont State AGNov 10 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ago.vermont.gov/document/2023-11-10-american-trading-and-production-corporation-data-breach-notice-consumers
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 10, 2023
Raw hash: a722d0a582564ae28d51eb7accf804547c93f6c4078af9628a240227c80e2612

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityAmerican Trading and Production Corporation

Victim entityAmerican Trading and Production Corporation

Incidentdiscovered May 4, 2022

Stated responseLaunched an investigation

ComplianceVT AG >45 bday

Extraction provenanceno artifact recorded

Source provenanceago.vermont.gov