MalwareManufacturingManufacturingRansomwareStolen CredentialsData ExfiltratedData EncryptedRansom DemandedEmployee Data InvolvedMulti-Stage ChainIdentity (basic)Government IDEmploymentMediumContained

Uponor North America

bd_b80ba0f4f20d76b0 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Nov 5, 2022

Filed

Apr 12, 2023

To disclose

23 weeks

Affected

4state residents only

Linked

3 filings

Confidence

66%

Full breach record for Uponor North America →2 incidents on file

Uponor North America, Inc. experienced a ransomware incident on November 5, 2022, which rendered operations inoperable. An unauthorized party exported data to an external cloud platform, including employee personnel files with names, SSNs, DOBs, and payroll info. The threat actor posted data on an internet site in mid-February 2023. Uponor contained the incident, engaged forensic investigators, reset credentials, and provided two years of Allstate Identity Protection to affected employees.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 23 weeks / 158 days

Nov 5, 2022

Begins

Nov 5, 2022

Discovered

Apr 12, 2023

Filed

vs. sector median

+12 wks slower

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Indiana State AGbd_f8454079f83b1cc32023-04-12Verified
Massachusetts State AGbd_62378133fd743b092023-04-13 · +1dVerified

Name: Uponor North America
norm: uponor north america

Name: Uponor North America
norm: uponor north america
Industry: Manufacturingllm

Discovered: Nov 5, 2022
Breach occurred: Nov 5, 2022
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 4state-resident count only
Data types: Identity (basic)Government IDEmployment
Data elements: Social Security numberDate of birth
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1041 Exfiltration Over C2 ChannelT1486 Data Encrypted for Impact
Threat actor: ExternalFinancial
Initial access: valid_credentials

During the incident: Took data centers offline and shut off all factory and internet connections
Identified and removed malicious files
Reset administrative and employee credentials
Rebuilt and recovered systems from known clean backups
Enhanced monitoring, logging, and detection capabilities
Retrained staff on cybersecurity
Retained global security professionals to conduct an independent investigation
Secured services of Allstate Identity Protection to provide identity monitoring for two years
Changes made: Enhanced monitoring, logging, and detection capabilities
Retrained staff on cybersecurity
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 23 weeks(158 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Indiana State AGApr 12 · first

Montana State AGApr 12 · first · this page

Massachusetts State AG+1d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-notification-letter-182.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 12, 2023
Raw hash: 3aced475e64bcd9b868243aee6e4f372bf6cdbf34a2d085ca9eb1503171f8e56

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityUponor North America

Victim entityUponor North America

Incidentdiscovered Nov 5, 2022

Stated responseTook data centers offline and shut off all factory and internet connections

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov