MalwareManufacturingManufacturingRansomwareData EncryptedData ExfiltratedRansom DemandedIdentity (basic)Government IDFinancial accountHealth (basic)MediumContained

Jacuzzi Inc.

bd_9ff477834a8ed12a · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jan 27, 2021

Filed

Feb 23, 2021

To disclose

27 days

Affected

2state residents only

Linked

5 filings

Confidence

66%

Full breach record for Jacuzzi Inc. →2 incidents on file

Jacuzzi Inc. notified the NH AG of a ransomware attack. Malware encrypted devices and prepared files for exfiltration on Dec 15, 2020. Access was disabled Dec 18. On Jan 27, 2021, Jacuzzi determined employee/beneficiary PII (SSN, bank info, DOB, health info) was potentially accessed. 2 NH residents notified on Feb 23, 2021. Credit monitoring offered.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 43 days

discovery → filing · 27 days

Dec 15, 2020

Begins

Jan 27, 2021

Discovered

Feb 23, 2021

Filed

vs. sector median

7 wks faster

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Massachusetts State AGbd_1380eb8e01b84dea2021-02-23Verified
Maine State AGbd_4fe807af058751a02021-02-23Candidate
Indiana State AGbd_b94dbfe76e79ea082021-02-23Verified
Montana State AGbd_f72c1dedb87e6b5b2021-02-23Verified

Name: WHITE & CASE LLP
norm: white case

Name: Jacuzzi Inc.
norm: jacuzzi
Industry: Manufacturingllm

Discovered: Jan 27, 2021
Breach occurred: Dec 15, 2020 – Dec 18, 2020
Undetected for: 43 daysoccurrence → discovery
Materiality determined: —
Notification sent: Feb 23, 2021
Affected individuals: 2state-resident count only
Data types: Identity (basic)Government IDFinancial accountHealth (basic)
Data elements: Social Security numberDate of birth
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Department of Justice

During the incident: Engaged a third party cyber security firm to assist in determining the nature and scope of the attack
Disabled internet access to the entire environment to contain the attack
Provided information to law enforcement about the incident
Notified all three national credit reporting agencies
Changes made: Secured the services of Kroll to provide identity monitoring at no cost to you for two years
Created a call center that potentially affected individuals can call with questions regarding the incident
Work with the third party cyber security firm to supplement and strengthen existing security measures
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 27 days(27 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Massachusetts State AGFeb 23 · first

Maine State AGFeb 23 · first

Indiana State AGFeb 23 · first

Montana State AGFeb 23 · first

New Hampshire State AGFeb 23 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/jacuzzi-20210223.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 23, 2021
Raw hash: 7d83987f205023d22503ea3e3f422a5cc088992d47dcdb9ac38d2ec9ed7264f8

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityWHITE & CASE LLP

Victim entityJacuzzi Inc.

Incidentdiscovered Jan 27, 2021

Stated responseEngaged a third party cyber security firm to assist in determining the nature and scope of the attack

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov