Social EngineeringEnergy & UtilitiesUtilitiesPhishingStolen CredentialsDelayed DiscoveryIdentity (basic)Government IDMediumActive

American Welding & Gas, Inc.

bd_ad9abc1ccf28f118 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jul 28, 2021

Filed

Sep 16, 2021

To disclose

7 weeks

Affected

77state residents only

Linked

3 filings

Confidence

64%

Full breach record for American Welding & Gas, Inc. →4 incidents on file

American Welding & Gas, Inc. notified Montana residents of a cybersecurity incident where an employee email account was compromised between July 22 and July 28, 2021. The breach exposed names and Social Security numbers of employees and shareholders. The company reported the incident to law enforcement and offered 12 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 6 days

discovery → filing · 7 weeks / 50 days

Jul 22, 2021

Begins

Jul 28, 2021

Discovered

Sep 16, 2021

Filed

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Indiana State AGbd_87ea9558731eac262021-09-16Verified
Maine State AGbd_fd5669a927bf78252021-10-21 · +35dVerified by operator

Name: American Welding & Gas, Inc.
norm: american welding gas

Name: American Welding & Gas, Inc.
norm: american welding gas
Industry: Energy & Utilitiesllm

Discovered: Jul 28, 2021
Breach occurred: Jul 22, 2021 – Jul 28, 2021
Undetected for: 6 daysoccurrence → discovery
Materiality determined: —
Notification sent: Sep 16, 2021
Affected individuals: 77state-resident count only
Data types: Identity (basic)Government ID
Data elements: Social Security number
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid Accounts
Threat actor: External
Regulator citations: Reported this incident to law enforcement
Initial access: phishing_link

During the incident: Immediately took steps to investigate this activity and change the account password
Reported this incident to law enforcement
Offering you access to 12 months of credit monitoring and identity theft restoration services through Experian at no cost to you
Changes made: Implementing additional safeguards to further protect the security of information in our systems
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 7 weeks(50 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Indiana State AGSep 16 · first

Montana State AGSep 16 · first · this page

Maine State AG+35d

Pattern: first filing Sep 16 (IN), last Oct 21 (ME) — a 35-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-Notification-9.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 16, 2021
Raw hash: eac85cd1dd8052c98653edda015618f3db1e53031eb99217172261755a297aea

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityAmerican Welding & Gas, Inc.

Victim entityAmerican Welding & Gas, Inc.

Incidentdiscovered Jul 28, 2021

Stated responseImmediately took steps to investigate this activity and change the account password

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov