HackingManufacturingManufacturingData ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDHighContained

Chatsworth Products, Inc.

bd_acf614b8f590b915 · schema v1 · pii pii-v1

Severity

High

Discovered

Feb 24, 2025

Filed

Apr 8, 2025

To disclose

6 weeks

Affected · nationwide

4,2232 in this filing

Linked

7 filings

Confidence

66%

Full breach record for Chatsworth Products, Inc. →

Chatsworth Products, Inc. disclosed an external system breach (hacking) occurring between Sept 12-23, 2024. Discovered Feb 24, 2025, the incident affected 4,223 individuals, including 2 Maine residents. Compromised data included names and Social Security numbers. CPI engaged third-party specialists, notified law enforcement, and provided 24 months of Experian credit monitoring.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Feb 24, 2025 → Filed with AG Apr 8, 202543d ⏱ ME AG >30d6 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 165 days

discovery → filing · 6 weeks / 43 days

Sep 12, 2024

Begins

Feb 24, 2025

Discovered

Apr 8, 2025

Filed

vs. sector median

5 wks faster

This filing is one of 7 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (6) · sorted by filing gap

New Hampshire State AGbd_2a81d1d90140860d2025-04-08Verified
Massachusetts State AGbd_50ae2e13a65f30e12025-04-08Verified
Nebraska State AGbd_6a8453bf9ccecaf02025-04-08Verified
Vermont State AGbd_9404739796031a6f2025-04-08Verified

Show 2 more filings ↓

California State AGbd_d4a4e7ab2b78e4ca2025-04-08Verified by operator
Indiana State AGbd_df56aba457c5c7b92025-04-08Verified

Name: Chatsworth Products, Inc.
norm: chatsworth products
Domain: chatsworth.com

Name: Chatsworth Products, Inc.
norm: chatsworth products
Domain: chatsworth.com
Industry: Manufacturingllm

Discovered: Feb 24, 2025
Breach occurred: Sep 12, 2024 – Sep 23, 2024
Undetected for: 165 daysoccurrence → discovery
Materiality determined: —
Notification sent: Apr 8, 2025
Affected individuals: 4,223state + nationwide
Data types: Identity (basic)Government ID
Data elements: Social Security number
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 Channel
Threat actor: External
Regulator citations: notifying potentially impacted individuals and providing complimentary access to credit monitoring servicesproviding written notice of this incident to relevant state regulators, as necessary, and to the three (3) major credit reporting agencies, Equifax, Experian, and TransUnion
Initial access: exploit_public_facing

During the incident: Took steps to secure their systems
Launched an investigation into the nature and scope of the activity with the assistance of third-party cybersecurity and data privacy specialists
Undertook a comprehensive and time-intensive review of the data at risk
Provided notification to impacted individuals
Notified federal law enforcement of the event
Took steps to ensure the privacy of the data at risk
Providing complimentary access to credit monitoring services for twenty-four (24) months, through Experian
Changes made: Reviewing existing security policies
Dedicating significant resources to implement additional cybersecurity measures to further protect against similar events moving forward
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 weeks(43 days from discovery to filing)
Compliance flags: ME AG >30d · 43d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Feb 24, 2025
→ Filed with AG: Apr 8, 2025
43d 30 days (soft) ME AG >30d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Feb 24, 2025 → Filed with AG: Apr 8, 2025	43d	30 days (soft)	ME AG >30d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 7 filings · 7 states

View merged incident ↗

New Hampshire State AGApr 8 · first

Massachusetts State AGApr 8 · first

Nebraska State AGApr 8 · first

Vermont State AGApr 8 · first

California State AGApr 8 · first

Indiana State AGApr 8 · first

Maine State AGApr 8 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/1a439c44-bd48-49f1-ac25-bac856133c81.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 8, 2025
Raw hash: d7fa55c75735c9a0ad38484f111e0d24fb4c780bfe2e359e9700fb843ead2a1f

Linked disclosures

Regulatory filings (6) · sorted by filing gap

Reporting entityChatsworth Products, Inc.

Victim entityChatsworth Products, Inc.

Incidentdiscovered Feb 24, 2025

Stated responseTook steps to secure their systems

ComplianceME AG >30d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov