HackingEnergy & UtilitiesUtilitiesVulnerability ExploitStolen CredentialsCL0PSupply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedEmployee Data InvolvedMass DistributionPIIIdentity (basic)EmploymentLowContained

SHELL USA, INC.

bd_b4a55b1a587ce55d · schema v1 · pii pii-v1

Severity

Low

Discovered

May 31, 2023

Filed

Jul 27, 2023

To disclose

8 weeks

Affected

1state residents only

Linked

2 filings

Confidence

67%

Full breach record for SHELL USA, INC. →

Shell USA, Inc. notified the NH Attorney General of a cybersecurity event involving the MOVEit Transfer software vulnerability. On May 31, 2023, Shell discovered unauthorized access to personal data of one New Hampshire resident, an employee of BG Group (a Shell affiliate). The attack was attributed to the CL0P hacker group exploiting a vulnerability in Progress Software's MOVEit Transfer. Data was exfiltrated. Shell patched the vulnerability on June 1, 2023, and contained the incident. Affected individuals were offered complimentary Experian IdentityWorks services.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 8 weeks / 57 days

May 31, 2023

Discovered

Jul 27, 2023

Filed

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Massachusetts State AGbd_6fb7015b30a4c30a2023-07-26 · +1dVerified

Name: SHELL USA, INC.
norm: shell usa

Name: SHELL USA, INC.
norm: shell usa
Industry: Energy & Utilitiesllm

Discovered: May 31, 2023
Materiality determined: —
Notification sent: Jul 27, 2023
Affected individuals: 1state-resident count only
Data types: PIIIdentity (basic)Employment
Attack vector: Third-Party / Supply Chain· CL0P
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 ChannelT1195 Supply Chain Compromise
Threat actor: CL0PExternal
Regulator citations: Submitted notice to the Attorney General of New Hampshire
Initial access: supply_chain

During the incident: Shell’s cyber defense team immediately began an investigation to determine if the software was in use and if it had been compromised
Shell initiated a process to understand what data may have been accessed without authorization
Shell patched the vulnerability to prevent further unauthorized access from this incident on June 1
Shell contained the vulnerability to prevent further unauthorized access from this incident
Shell sent a preliminary email notification to impacted individuals for whom we had a valid email address on July 5
Shell will be mailing formal notifications to all impacted New Hampshire residents on or about July 27, 2023
Shell’s cyber defence team continues to proactively monitor external and internal sources for any additional developments related to this incident
Changes made: Offering complimentary access to Experian IdentityWorksSM for identity restoration and fraud detection
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 weeks(57 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Massachusetts State AGJul 26 · first

New Hampshire State AG+1d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/shell-usa-20230727.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 27, 2023
Raw hash: 1d2545f1193c004a10988dc2c76edcdc4168cb56e30cf9f7fcef5b25f37c04df

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entitySHELL USA, INC.

Victim entitySHELL USA, INC.

Incidentdiscovered May 31, 2023

Stated responseShell’s cyber defense team immediately began an investigation to determine if the software was in use and if it had been compromised

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov