MalwareManufacturingManufacturingRansomwareData EncryptedTargetedIdentity (basic)Government IDMediumContained

Penhall Company

bd_b0031b1b7ef3c4fd · schema v1 · pii pii-v1

Severity

Medium

Discovered

Dec 28, 2022

Filed

Feb 15, 2023

To disclose

5 weeks

Affected

3state residents only

Linked

4 filings

Confidence

66%

Full breach record for Penhall Company →

Penhall Company notified Montana residents of a December 28, 2022 data security incident where systems were encrypted. Forensic investigation on January 13, 2023 confirmed unauthorized access to personal information including names, SSNs, and driver's license numbers. Penhall secured systems, initiated restoration, and offered one year of Experian IdentityWorks.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 7 weeks / 49 days

Dec 28, 2022

Begins

Dec 28, 2022

Discovered

Feb 15, 2023

Filed

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Maine State AGbd_4de776dec448f0b62023-02-15Verified
California State AGbd_78af2fa31cdd1e782023-02-15Candidate
Indiana State AGbd_defba4cb2f8e60552023-02-15Verified

Name: Penhall Company
norm: penhall

Name: Penhall Company
norm: penhall
Industry: Manufacturingllm

Discovered: Dec 28, 2022
Breach occurred: Dec 28, 2022
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 3state-resident count only
Data types: Identity (basic)Government ID
Data elements: Social Security number
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for Impact
Threat actor: ExternalFinancial

During the incident: Secured our systems
Began the restoration process
Initiated an investigation into the cause and scope of the incident
Offering you a complimentary one-year membership to Experian’s® IdentityWorksSM
Changes made: Implemented additional security measures to enhance our existing cybersecurity protocols
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 weeks(33 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Maine State AGFeb 15 · first

California State AGFeb 15 · first

Indiana State AGFeb 15 · first

Montana State AGFeb 15 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-notification-letter-70.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 15, 2023
Raw hash: b81b6e6be8bd0cf6a40b48493f771c938f19daffdc3aa52da3117d646b567284

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityPenhall Company

Victim entityPenhall Company

Incidentdiscovered Dec 28, 2022

Stated responseSecured our systems

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov