HackingManufacturingManufacturingData ExfiltratedCustomer Data InvolvedIdentity (basic)LowContained

PGT Innovations, Inc.

bd_c27185b56d90bee8 · schema v1 · pii pii-v1

Severity

Low

Discovered

Nov 5, 2022

Filed

Apr 3, 2023

To disclose

21 weeks

Affected

Not disclosed

Linked

7 filings

Confidence

65%

Full breach record for PGT Innovations, Inc. →

PGT Innovations detected unauthorized access to its network on November 5, 2022. A subsequent forensic investigation determined that an unauthorized party potentially removed files containing personal information (names) between October 13, 2022, and November 29, 2022. The company contained the threat, restored data, notified law enforcement, and engaged external cybersecurity professionals. Complimentary credit monitoring was offered to affected individuals.

J jump to incidentP pin to compareR raw source

Leak gap clock⏱ Leak >90d21 weeks discovery → filing

Incident timeline

undetected · 23 days

discovery → filing · 21 weeks / 149 days

Oct 13, 2022

Begins

Nov 5, 2022

Discovered

Apr 3, 2023

Filed

This filing is one of 7 about the same incident.View merged incident

A leak claim by blacksuit about this victim predates this filing by 122 days.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (2)

Leak Siteblacksuitbd_c46d0405bf3ad1ce2022-12-16 · +108dVerified by operator
Leak Siteblacksuitbd_5ae910eea47508eb2022-12-02 · +122dVerified by operator

Regulatory filings (4) · sorted by filing gap

Maine State AGbd_16bd95df5aef05362023-04-03Verified by operator
Indiana State AGbd_3a255097d21ed31b2023-04-03Verified
SEC 8-Kbd_f2e2d638ada8335a2023-04-06 · +3dVerified by operator
Massachusetts State AGbd_4a66f40503b4c1bc2023-04-07 · +4dVerified by operator

Name: PGT Innovations, Inc.
norm: pgt innovations
Domain: pgtinnovations.com

Name: PGT Innovations, Inc.
norm: pgt innovations
Domain: pgtinnovations.com
Industry: Manufacturingllm

Discovered: Nov 5, 2022
Breach occurred: Oct 13, 2022 – Nov 29, 2022
Undetected for: 23 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: Identity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1041 Exfiltration Over C2 Channel
Threat actor: External

During the incident: Contained the threat by disabling all unauthorized access to our network
Restored all data
Notified law enforcement
Engaged external cybersecurity professionals experienced in handling these types of incidents
Changes made: Updating passwords
Enhancing email access protocols
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 21 weeks(149 days from discovery to filing)
Compliance flags: Leak >90d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 4 states

View merged incident ↗

Maine State AGApr 3 · first

Indiana State AGApr 3 · first

California State AGApr 3 · first · this page

SEC 8-K+3d

Massachusetts State AG+4d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-565056
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 3, 2023
Raw hash: 8f7e2d164d5c643e55c806a2b613425e54882d7a3e9b20f01baa478049f9f014

Linked disclosures

Ransomware claims (2)

Regulatory filings (4) · sorted by filing gap

Reporting entityPGT Innovations, Inc.

Victim entityPGT Innovations, Inc.

Incidentdiscovered Nov 5, 2022

Stated responseContained the threat by disabling all unauthorized access to our network

ComplianceLeak >90d

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov