HackingTechnologyInformationData ExfiltratedData PublishedEmployee Data InvolvedIdentity (basic)Government IDMediumActive

Symbotic Inc.

bd_bb4b6191ab789666 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Apr 26, 2020

Filed

Jun 1, 2020

To disclose

5 weeks

Affected

3state residents only

Linked

3 filings

Confidence

66%

Full breach record for Symbotic Inc. →

Symbotic LLC notified the NH Attorney General of an unauthorized access incident discovered on April 26, 2020. An external actor accessed systems and acquired data belonging to three New Hampshire residents, including names, addresses, and Social Security numbers. The data was posted on a website (Mega.oz) on May 14, 2020, and removed on May 15, 2020. The investigation is ongoing. Symbotic engaged forensic specialists, notified the FBI, secured systems, and offered 18 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 5 weeks / 36 days

Apr 26, 2020

Begins

Apr 26, 2020

Discovered

Jun 1, 2020

Filed

vs. sector median

13 wks faster

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Massachusetts State AGbd_814ab8b5481b12872020-05-27 · +5dVerified
Indiana State AGbd_a70ab923ae97e9042020-05-26 · +6dVerified

Name: Symbotic Inc.
norm: symbotic

Name: Symbotic Inc.
norm: symbotic
Industry: Technologyllm

Discovered: Apr 26, 2020
Breach occurred: Apr 26, 2020
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: May 26, 2020
Affected individuals: 3state-resident count only
Data types: Identity (basic)Government ID
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1041 Exfiltration Over C2 ChannelT1074 Data StagedT1560 Archive Collected Data
Threat actor: External
Regulator citations: Notified the FBINotified the New Hampshire Attorney General

During the incident: Launched an investigation with the assistance of outside computer forensics specialists
Notified the FBI and continues to support the FBI's investigation
Worked with third-party specialists to secure its systems
Implemented additional network and endpoint monitoring
Provided written notice to all affected individuals
Offered access to credit monitoring services for 18 months through Kroll
Changes made: Implemented additional network and endpoint monitoring
Provided impacted individuals with guidance on how to better protect against identity theft and fraud
Provided information on how to place a fraud alert and security freeze on credit files
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 weeks(36 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Indiana State AGMay 26 · first

Massachusetts State AG+1d

New Hampshire State AG+6d · this page

Pattern: first filing May 26 (IN), last Jun 1 (NH) — a 6-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/symbotic-20200601.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 1, 2020
Raw hash: d06bf763752b7846e4240855da3bb9d131579977b6f0775d863acdf65f37fcc7

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entitySymbotic Inc.

Victim entitySymbotic Inc.

Incidentdiscovered Apr 26, 2020

Stated responseLaunched an investigation with the assistance of outside computer forensics specialists

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov