MalwareManufacturingManufacturingRansomwareData ExfiltratedRansom DemandedCustomer Data InvolvedGovernment IDIdentity (basic)Financial accountFinancial credentialsMediumContained

Plug Power Inc.

bd_b0cc7596c5b90898 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Mar 22, 2023

Filed

Dec 15, 2023

To disclose

38 weeks

Affected

25state residents only

Linked

4 filings

Confidence

66%

Full breach record for Plug Power Inc. →3 incidents on file

Plug Power Inc. notified the New Hampshire Attorney General of a ransomware incident affecting 25 state residents. Unauthorized access occurred between March 13-23, 2023. The breach exposed names, SSNs, passport numbers, and financial account details. Plug Power engaged forensic experts, notified law enforcement, and offered 24 months of credit monitoring to affected individuals.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 9 days

discovery → filing · 38 weeks / 268 days

Mar 13, 2023

Begins

Mar 22, 2023

Discovered

Dec 15, 2023

Filed

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Montana State AGbd_a7a20cf50beef4f52023-12-15Candidate
Maine State AGbd_cea3305b3d38602b2023-12-15Verified by operator
Vermont State AGbd_fdd829aeab061acf2023-12-15Verified

Name: Plug Power Inc.
norm: plug power
Domain: plugpower.com

Name: Plug Power Inc.
norm: plug power
Domain: plugpower.com
Industry: Manufacturingllm

Discovered: Mar 22, 2023
Breach occurred: Mar 13, 2023 – Mar 23, 2023
Undetected for: 9 daysoccurrence → discovery
Materiality determined: —
Notification sent: Dec 15, 2023
Affected individuals: 25state-resident count only
Data types: Government IDIdentity (basic)Financial accountFinancial credentials
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1119 Automated Collection
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Office of the Attorney General

During the incident: Engaged third-party cyber experts to determine the nature and scope of the incident
Notified law enforcement
Offered complimentary subscription for credit monitoring services through IDX protection services
Changes made: Recovered and restored impacted systems
Made additional improvements that strengthen cybersecurity protections
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 38 weeks(268 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Montana State AGDec 15 · first

Maine State AGDec 15 · first

Vermont State AGDec 15 · first

New Hampshire State AGDec 15 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/plug-power-20231215.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 15, 2023
Raw hash: d50c538b6e20892a3bf1393185db56cc5fe19363f21deece4b239fd4ddbba034

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityPlug Power Inc.

Victim entityPlug Power Inc.

Incidentdiscovered Mar 22, 2023

Stated responseEngaged third-party cyber experts to determine the nature and scope of the incident

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov