HackingRetail & ConsumerRetailTargetedData ExfiltratedIdentity (basic)Government IDMediumActive

Hammond Lumber Company

bd_b634f1603204ff31 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Mar 21, 2023

Filed

May 25, 2023

To disclose

9 weeks

Affected

74state residents only

Linked

6 filings

Confidence

66%

Full breach record for Hammond Lumber Company →

Hammond Lumber Company notified the NH AG of a data event affecting 74 NH residents. Suspicious activity was identified on March 21, 2023. Files were copied without authorization. Hammond notified law enforcement, provided credit monitoring, and sent notices to affected individuals.

J jump to incidentP pin to compareR raw source

Leak gap clock⏱ Leak >30d9 weeks discovery → filing

⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Incident timeline

discovery → filing · 9 weeks / 65 days

Mar 21, 2023

Begins

Mar 21, 2023

Discovered

May 25, 2023

Filed

vs. sector median

+2 wks slower

This filing is one of 6 about the same incident.View merged incident

A leak claim by lockbit_3 about this victim predates this filing by 57 days.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Sitelockbit_3bd_2d92c98054a9f4642023-03-29 · +57dCandidate

Regulatory filings (4) · sorted by filing gap

Maine State AGbd_0eb9d39c5c3421292023-05-16 · +9dVerified
Vermont State AGbd_3d468a3b183e3a9f2023-05-16 · +9dVerified
Massachusetts State AGbd_f47c7151352260882023-05-16 · +9dVerified by operator
Maine State AGbd_079111770019ae242023-04-20 · +35dVerified

Name: Hammond Lumber Company
norm: hammond lumber
Domain: hammondlumber.com

Name: Hammond Lumber Company
norm: hammond lumber
Domain: hammondlumber.com
Industry: Retail & Consumerllm

Discovered: Mar 21, 2023
Breach occurred: Mar 21, 2023
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: May 15, 2023
Affected individuals: 74state-resident count only
Data types: Identity (basic)Government ID
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1119 Automated Collection
Threat actor: External
Regulator citations: Notified New Hampshire Attorney General Consumer Protection BureauNotified federal law enforcement

During the incident: Began an investigation to assess the scope of the event and identify potentially affected individuals
Notified federal law enforcement regarding the event
Began providing written notice of this event to seventy-four (74) New Hampshire residents
Providing access to credit monitoring services for one (1) year through Experian
Providing potentially impacted individuals with guidance on how to better protect against identity theft and fraud
Providing written notice of this event to relevant state regulators
Providing written notice of this event to the three major credit reporting agencies
Changes made: Evaluating additional safeguards to mitigate risk of reoccurrence
Implementing additional technical security measures
Reviewing our policies and procedures to mitigate reoccurrence of this type of event
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 9 weeks(65 days from discovery to filing)
Compliance flags: Leak >30d
Discovery-date grounding: occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 4 states

View merged incident ↗

Maine State AGApr 20 · first

Maine State AG+26d

Vermont State AG+26d

Massachusetts State AG+26d

New Hampshire State AG+35d · this page

Pattern: first filing Apr 20 (ME), last May 25 (NH) — a 35-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/hammond-lumber-20230525.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 25, 2023
Raw hash: 563b9331e2cc0d1e1eca1148629e84cefdf8dc1a5fc61fda6570aeb4fa533e23

Linked disclosures

Ransomware claims (1)

Regulatory filings (4) · sorted by filing gap

Reporting entityHammond Lumber Company

Victim entityHammond Lumber Company

Incidentdiscovered Mar 21, 2023

Stated responseBegan an investigation to assess the scope of the event and identify potentially affected individuals

ComplianceLeak >30d

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov