HackingTransportation & LogisticsTransportationStolen CredentialsData ExfiltratedData PublishedCustomer Data InvolvedPIIIdentity (basic)Government IDMediumContained

Arrow Truck Sales, Inc.

bd_9fa6ee17d658e164 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Nov 30, 2020

Filed

Feb 26, 2021

To disclose

13 weeks

Affected

Not disclosed

Linked

6 filings

Confidence

65%

Full breach record for Arrow Truck Sales, Inc. →4 incidents on file

Arrow Truck Sales, Inc. disclosed a cybersecurity incident where an unauthorized third party gained remote access to its network on or about November 30, 2020. The attacker acquired internal company information, including personal data of affected individuals, and posted it on a publicly accessible website. The company engaged outside cybersecurity experts, contacted law enforcement, and enhanced security protections. Affected individuals were offered two years of complimentary identity monitoring services through Kroll.

J jump to incidentP pin to compareR raw source

California clockDiscovered Nov 30, 2020 → Notified May 30, 2021181d ✗ CA 60-day late13 weeks discovery → filing

Incident timeline

undetected · 14 days

discovery → filing · 13 weeks / 88 days

Nov 16, 2020

Begins

Nov 30, 2020

Discovered

Feb 26, 2021

Filed

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

New Hampshire State AGbd_373843c6816859362021-01-11 · +46dVerified
Maine State AGbd_585682e4c3c1c2c82021-01-11 · +46dVerified
Montana State AGbd_0b21a15a92a0fab42021-01-08 · +49dCandidate
Indiana State AGbd_2062fd4c4f77c3212021-01-08 · +49dVerified

Show 1 more filing ↓up to 56d gap

Illinois State AGbd_46e4f92a41895baa2021-01-01 · +56dVerified

Name: Arrow Truck Sales, Inc.
norm: arrow truck sales

Name: Arrow Truck Sales, Inc.
norm: arrow truck sales
Industry: Transportation & Logisticsllm

Discovered: Nov 30, 2020
Breach occurred: Nov 16, 2020
Undetected for: 14 daysoccurrence → discovery
Materiality determined: —
Notification sent: May 30, 2021
Affected individuals: Not disclosed
Data types: PIIIdentity (basic)Government ID
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1041 Exfiltration Over C2 ChannelT1560 Data from Cloud Storage Object
Threat actor: External
Regulator citations: Contacted law enforcement

During the incident: Took steps to secure our network
Began to investigate the incident with the support of outside cybersecurity experts
Contacted law enforcement
Engaged outside cybersecurity experts to help remediate and ensure the ongoing security of our systems
Enhanced cybersecurity protections throughout our environment
Secured the services of Kroll to provide identity services at no cost to you for two years
Changes made: Enhanced cybersecurity protections throughout our environment
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 13 weeks(88 days from discovery to filing)
Compliance flags: CA 60-day late · 181d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Nov 30, 2020
→ Notified: May 30, 2021
181d 60 days (analyst band, pre-2026 discoveries) CA 60-day late

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Nov 30, 2020 → Notified: May 30, 2021	181d	60 days (analyst band, pre-2026 discoveries)	CA 60-day late

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

Illinois State AGJan 1 · first

Montana State AG+7d

Indiana State AG+7d

New Hampshire State AG+10d

Maine State AG+10d

California State AG+56d · this page

Pattern: first filing Jan 1 (IL), last Feb 26 (CA) — a 56-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-538385
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 26, 2021
Raw hash: 7e0083516c1f1c172210816a850b5b6506f76cf86096afab87691f98f5b390f0

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityArrow Truck Sales, Inc.

Victim entityArrow Truck Sales, Inc.

Incidentdiscovered Nov 30, 2020

Stated responseTook steps to secure our network

ComplianceCA 60-day late

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov