MalwareRetail & ConsumerRetailRansomwareStolen CredentialsMulti-Stage ChainData ExfiltratedCustomer Data InvolvedEmployee Data InvolvedPIIIdentity (basic)Government IDMediumActive

EDW. C. Levy Co.

bd_a726a2229de3cf78 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Nov 1, 2023

Filed

Jan 17, 2025

To disclose

15 months

Affected

1state residents only

Linked

5 filings

Confidence

67%

Full breach record for EDW. C. Levy Co. →3 incidents on file

Edw. C. Levy Co. notified the NH Attorney General of a ransomware attack discovered on Nov 1, 2023. The incident involved unauthorized access to employee files and an email account. One New Hampshire resident's PII (including SSN) was potentially exposed. Notice was sent to the resident on Jan 16, 2025, offering credit monitoring. Investigation remains ongoing.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 15 months / 443 days

Nov 1, 2023

Discovered

Jan 17, 2025

Filed

vs. sector median

+56 wks slower

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Maine State AGbd_b1187897469e67192025-01-17Verified
Massachusetts State AGbd_325a2c611809b3602025-01-18 · +1dVerified
Montana State AGbd_4953a48093c7bc112025-01-16 · +1dCandidate
Nebraska State AGbd_eba03edc0bc0541e2025-01-16 · +1dVerified

Name: EDW. C. Levy Co.
norm: edw c levy

Name: EDW. C. Levy Co.
norm: edw c levy
Industry: Retail & Consumerllm

Discovered: Nov 1, 2023
Materiality determined: —
Notification sent: Jan 16, 2025
Affected individuals: 1state-resident count only
Data types: PIIIdentity (basic)Government ID
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: reported this incident to federal law enforcementprovided notice to the Office of the Attorney General Consumer Protection Bureau
Initial access: valid_credentials

During the incident: Began working with its I.T. team and third-party forensic specialists to investigate the full nature and scope of the incident
Reported this incident to federal law enforcement
Provided notice to potentially impacted employees on December 27, 2023
Performed a comprehensive review of the contents of the email account
Provided notice to individuals whose personal information was contained therein accordingly
Undertook a comprehensive and time-intensive process to identify the information that may have been contained within the potentially impacted files
Undertook a time-consuming, manual review of its internal records
Provided written notice of this incident to the potentially impacted New Hampshire resident
Offer of complimentary credit monitoring and identity protection services
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 15 months(443 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Montana State AGJan 16 · first

Nebraska State AGJan 16 · first

Maine State AG+1d

New Hampshire State AG+1d · this page

Massachusetts State AG+2d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/edw-c-levy-20250117.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 17, 2025
Raw hash: 92e2cf29374389ee2ef7cf044a32a58a3eaa6751ee011482b229c5bda68b0898

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityEDW. C. Levy Co.

Victim entityEDW. C. Levy Co.

Incidentdiscovered Nov 1, 2023

Stated responseBegan working with its I.T. team and third-party forensic specialists to investigate the full nature and scope of the incident

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov