HackingOtherData ExfiltratedCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)MinorMediumContained

CEDAR GROVE COMPOSTING, INC.

bd_a5193c77cb48ed02 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Sep 7, 2021

Filed

Nov 30, 2021

To disclose

12 weeks

Affected

35state residents only

Linked

5 filings

Confidence

66%

Full breach record for CEDAR GROVE COMPOSTING, INC. →

Cedar Grove Composting, Inc. notified Montana and other state residents of unauthorized network access in August 2021, discovered September 7, 2021. Files may have been downloaded, potentially impacting names and minor information. The company notified law enforcement, enhanced security, and offered credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 37 days

discovery → filing · 12 weeks / 84 days

Aug 1, 2021

Begins

Sep 7, 2021

Discovered

Nov 30, 2021

Filed

vs. sector median

+4 wks slower

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Sitecontibd_7b435e63ef2c3ab32021-09-24 · +67dVerified by operator

Regulatory filings (3) · sorted by filing gap

Indiana State AGbd_0ccdf85299be7ebf2021-11-30Verified by operator
Washington State AGbd_1f7fe7e02d6a531f2021-11-30Candidate
Massachusetts State AGbd_61b62b0c7be37aa32021-11-30Verified

Name: CEDAR GROVE COMPOSTING, INC.
norm: cedar grove composting

Name: CEDAR GROVE COMPOSTING, INC.
norm: cedar grove composting
Industry: Otherllm

Discovered: Sep 7, 2021
Breach occurred: Aug 1, 2021
Undetected for: 37 daysoccurrence → discovery
Materiality determined: —
Notification sent: Nov 30, 2021
Affected individuals: 35state-resident count only
Data types: Identity (basic)Minor
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1041 Exfiltration Over C2 Channel
Threat actor: External
Regulator citations: Notified federal law enforcement regarding the eventNotifying regulatory authorities, as required

During the incident: Notified federal law enforcement regarding the event
Implemented additional technical security measures
Reviewing and enhancing existing policies and procedures
Providing additional training to our employees regarding data security
Notifying regulatory authorities, as required
Offering access to complimentary monitoring services through IDX
Changes made: Implemented additional technical security measures
Reviewing and enhancing existing policies and procedures
Providing additional training to our employees regarding data security
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 12 weeks(84 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Indiana State AGNov 30 · first

Washington State AGNov 30 · first

Massachusetts State AGNov 30 · first

Montana State AGNov 30 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-Notification-Letter-112.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 30, 2021
Raw hash: a15b5501d5341d35025a344a61e961670260afceee78a3a099e5288bab594b53

Linked disclosures

Ransomware claims (1)

Regulatory filings (3) · sorted by filing gap

Reporting entityCEDAR GROVE COMPOSTING, INC.

Victim entityCEDAR GROVE COMPOSTING, INC.

Incidentdiscovered Sep 7, 2021

Stated responseNotified federal law enforcement regarding the event

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov