HackingRetail & ConsumerRetailStolen CredentialsCustomer Data InvolvedIdentity (basic)Government IDHealth (basic)Financial accountMediumContained

Johnstone Supply

bd_a003142b11ab39a2 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Nov 22, 2022

Filed

Feb 24, 2023

To disclose

13 weeks

Affected

2state residents only

Confidence

66%

Full breach record for Johnstone Supply →

Wallace Supply LLC d/b/a Johnstone Supply notified Delaware residents of a data event involving unauthorized access to an employee email account between November 15 and 22, 2022. The unauthorized actor logged into the account, potentially accessing names, SSNs, driver's license numbers, medical/health insurance info, and financial account data. Two Delaware residents were notified on February 24, 2023. The company secured the account, investigated, and offered 12 months of credit monitoring via Experian.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 7 days

discovery → filing · 13 weeks / 94 days

Nov 15, 2022

Begins

Nov 22, 2022

Discovered

Feb 24, 2023

Filed

vs. sector median

+6 wks slower

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed4 affectedView incident

Name: Johnstone Supply
norm: johnstone supply
Domain: johnstonesupply.com

Name: Johnstone Supply
norm: johnstone supply
Domain: johnstonesupply.com
Also named: Wallace Supply LLCdba oflegal entity
Johnstone Supplydba oftrade name
Industry: Retail & Consumerllm

Discovered: Nov 22, 2022
Breach occurred: Nov 15, 2022 – Nov 22, 2022
Undetected for: 7 daysoccurrence → discovery
Materiality determined: —
Notification sent: Feb 24, 2023
Affected individuals: 2state-resident count only
Data types: Identity (basic)Government IDHealth (basic)Financial account
Data elements: Social Security numberMedical information
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1114 Email Collection
Threat actor: External
Initial access: valid_credentials

During the incident: Secured the email account involved
Launched an investigation to determine the full nature and scope of the incident
Undertook a comprehensive review of the contents of the impacted email account
Provided written notice of this incident to two (2) Delaware residents
Providing access to credit monitoring services for twelve (12) months, through Experian
Changes made: Implementing additional safeguards and training to its employees
Reviewing and enhancing policies and procedures regarding information security
Implementing multifactor authentication for its email accounts
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 13 weeks(94 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://attorneygeneral.delaware.gov/wp-content/uploads/sites/50/2023/03/Johnstone-Supply-Notice-of-Data-Event-DE.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 24, 2023
Raw hash: ea15c52c92a6e736516e3d2db99a791aa2391773e68aacd9b29bfcf72da15a4e

Reporting entityJohnstone Supply

Victim entityJohnstone Supply

Incidentdiscovered Nov 22, 2022

Stated responseSecured the email account involved

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceattorneygeneral.delaware.gov