HackingRetail & ConsumerRetailStolen CredentialsData ExfiltratedTargetedIdentity (basic)Government IDFinancial accountHighContained

SYSCO CORPORATION

bd_a670fc947a726bf3 · schema v1 · pii pii-v1

Severity

High

Discovered

Mar 5, 2023

Filed

May 17, 2023

To disclose

10 weeks

Affected

1,503state residents only

Linked

11 records

Confidence

64%

Full breach record for SYSCO CORPORATION →3 incidents on file

Sysco Corporation notified South Carolina of a cybersecurity event where a threat actor gained unauthorized access to systems starting Jan 14, 2023. Discovered March 5, 2023, the incident impacted personal info of current/former colleagues, including SSNs and payroll data. Sysco engaged forensic experts, notified law enforcement, and offered 24 months of credit monitoring.

J jump to incidentP pin to compareR raw source

South Carolina clock✓ SC CRA notice due10 weeks discovery → filing

Incident timeline

undetected · 50 days

discovery → filing · 10 weeks / 73 days

Jan 14, 2023

Begins

Mar 5, 2023

Discovered

May 17, 2023

Filed

vs. sector median

+1 wks slower

This filing is one of 11 records about the same incident.View merged incident

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Sitedunghillbd_23944c27089111552023-05-27 · +10dVerified by operator

Regulatory filings (9) · sorted by filing gap

Massachusetts State AGbd_050ce61aec90f9112023-05-17Verified by operator
Washington State AGbd_44c863a405c6225f2023-05-17Verified by operator
Maine State AGbd_5d5516fe15b8939c2023-05-17Verified by operator
Hawaii State AGbd_e3b3f0b86bc7928e2023-05-17Verified by operator

Show 5 more filings ↓up to 136d gap

California State AGbd_090a2297858052432023-05-16 · +1dVerified by operator
Oregon State AGbd_3041dfe2cdc8303f2023-05-16 · +1dVerified by operator
New Hampshire State AGbd_9478a567d0d141412023-05-16 · +1dVerified by operator
Indiana State AGbd_cc2a933e586ea52a2023-05-05 · +12dVerified by operator
Illinois State AGbd_c18a45d8d04a0a202023-01-01 · +136dVerified by operator

Name: SYSCO CORPORATION
norm: sysco
Domain: sysco.com

Name: SYSCO CORPORATION
norm: sysco
Domain: sysco.com
Industry: Retail & Consumerllm

Discovered: Mar 5, 2023
Breach occurred: Jan 14, 2023
Undetected for: 50 daysoccurrence → discovery
Materiality determined: —
Notification sent: May 12, 2023
Affected individuals: 1,503state-resident count only
Data types: Identity (basic)Government IDFinancial account
Data elements: Social Security number
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1119 Automated Collection
Threat actor: ExternalFinancial
Regulator citations: Notified federal law enforcement
Initial access: valid_credentials

During the incident: Opened an investigation in partnership with a leading cybersecurity firm and other experts
Notified federal law enforcement
Implemented additional controls and safeguards
Changes made: Implemented additional controls and safeguards to help prevent a similar event from occurring in the future
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 10 weeks(73 days from discovery to filing)
Compliance flags: SC CRA notice due
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 10 filings · 10 states

View merged incident ↗

Illinois State AGJan 1 · first

Indiana State AG+124d

California State AG+135d

Oregon State AG+135d

New Hampshire State AG+135d

Massachusetts State AG+136d

Washington State AG+136d

Maine State AG+136d

Hawaii State AG+136d

South Carolina State AG+136d · this page

Pattern: first filing Jan 1 (IL), last May 17 (SC) — a 136-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2023/SyscoCorporation.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 17, 2023
Raw hash: 5bbd3c8c81d8826f092c484d9aa3eeaeda1ae7b6e9ce82b0c0b3e94055d87dc9

Linked disclosures

Ransomware claims (1)

Regulatory filings (9) · sorted by filing gap

Reporting entitySYSCO CORPORATION

Victim entitySYSCO CORPORATION

Incidentdiscovered Mar 5, 2023

Stated responseOpened an investigation in partnership with a leading cybersecurity firm and other experts

ComplianceSC CRA notice due

Extraction provenanceno artifact recorded

Source provenanceconsumer.sc.gov