HackingStolen CredentialsSupply Chain (3P Vendor)Customer Data InvolvedIDENTITY_BASICCREDENTIALSLowActive
Western Tool & Supply Co.
bd_9fc19bde12d5f814 · schema v1 · pii pii-v1
Full breach record for Western Tool & Supply Co. →Western Tool & Supply Co. voluntarily notified the Idaho Attorney General of a data breach involving its third-party e-commerce platform provider, SignatureIT Ltd. On November 16, 2023, SignatureIT detected unauthorized access via the Confluence collaboration platform. Approximately 11 U.S. residents' personal information (names, addresses, credentials) was potentially compromised. Western Tool notified the FBI, CISA, state agencies, and the EU. The Company's own systems were not accessed.
Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed11 affectedView incident
Source provenance
- Source URL
- https://www.ag.idaho.gov/content/uploads/2023/12/12-19-2023-Western-Tool-Supply-Co.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Dec 19, 2023
- Raw hash
- 68f3158ee3c8f4e6906b05ca329fef39303d777c21380a09290e6acfe426ba42
Reporting entity
- Name
- Western Tool & Supply Co.norm: western tool supply
Victim entity
- Name
- Western Tool & Supply Co.norm: western tool supply
Incident
- Discovered
- Nov 16, 2023
- Materiality determined
- —
- Notification sent
- Dec 19, 2023
- Affected individuals
- 11
- Data types
- IDENTITY_BASICCREDENTIALS
- Attack vector
- Third-Party / Supply Chain
- MITRE ATT&CK
- T1190 Exploit Public-Facing Application
- Threat actor
- External
- Regulator citations
- Notified the U.S. Federal Bureau of InvestigationNotified the Cybersecurity and Infrastructure Security Agency under the Cyber Incident Reporting for Critical Infrastructure ActNotified applicable U.S. state agenciesNotified the E.U. under the General Data Protection Regulation
- Third party
- via SignatureIT Ltd.
- Initial access
- exploit_public_facing
Compliance
- Time to disclose
- 5 weeks(33 days from discovery to filing)
- Compliance flags
- — (clock not assessable for this source)
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.