HackingTechnologyInformationData ExfiltratedCustomer Data InvolvedPIIIdentity (basic)LowContained

Constellation Software Inc.

bd_b6cc684d4d89fc1a · schema v1 · pii pii-v1

Severity

Low

Discovered

—

Filed

May 12, 2023

To disclose

—

Affected

Not disclosed

Linked

5 filings

Confidence

66%

Full breach record for Constellation Software Inc. →

Constellation Software Inc. reported that an unauthorized third party gained access to its systems between February 27, 2023, and April 3, 2023. The attacker viewed and took files from certain servers. A forensic investigation was conducted, and it was determined that some files contained personal information of consumers. The company contained the incident, restored systems from backups, deployed EDR, and reinforced network security. Affected individuals are offered 12 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

Feb 27, 2023

Begins

May 12, 2023

Filed

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Indiana State AGbd_ea2952588b100c9c2023-05-08 · +4dVerified
New Hampshire State AGbd_5956b91aa79a4b362023-05-25 · +13dVerified
Maine State AGbd_b9631555636ec7d92023-05-25 · +13dCandidate
Massachusetts State AGbd_d5a59a6d31b150b22023-05-25 · +13dVerified

Name: Constellation Software Inc.
norm: constellation software

Name: Constellation Software Inc.
norm: constellation software
Industry: Technologyllm

Discovered: —
Breach occurred: Feb 27, 2023 – Apr 3, 2023
Materiality determined: —
Notification sent: May 12, 2023
Affected individuals: Not disclosed
Data types: PIIIdentity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1041 Exfiltration Over C2 Channel
Threat actor: External
Regulator citations: Notified law enforcement

During the incident: Took steps to prevent against further unauthorized activity
Retained a third-party cybersecurity firm to assist with containment, remediation and to conduct a forensic investigation
Notified law enforcement and is supporting its investigation
Isolating affected systems and securely restoring them from backups
Deploying endpoint detection and response tooling across the environment along with active threat monitoring
Reinforcing network perimeter security
Providing 12 months of credit monitoring and identity theft protection
Changes made: Isolating affected systems and securely restoring them from backups
Deploying endpoint detection and response tooling across the environment along with active threat monitoring
Reinforcing network perimeter security
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Indiana State AGMay 8 · first

Vermont State AG+4d · this page

New Hampshire State AG+17d

Maine State AG+17d

Massachusetts State AG+17d

Pattern: first filing May 8 (IN), last May 25 (MA) — a 17-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ago.vermont.gov/document/2023-05-12-constellation-software-data-breach-notice-consumers
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 12, 2023
Raw hash: a9d95cfb5042c57e99e2186247f1f1282d112ae6c9b4e7e8796526dab100f2a0

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityConstellation Software Inc.

Victim entityConstellation Software Inc.

IncidentUnauthorized Access

Stated responseTook steps to prevent against further unauthorized activity

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceago.vermont.gov