MalwareRetail & ConsumerRetailRansomwareData EncryptedTargetedIdentity (basic)Government IDMediumContained

BOB'S RED MILL NATURAL FOODS, INC.

bd_c2771f0f144138e4 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Nov 28, 2021

Filed

Jan 24, 2022

To disclose

8 weeks

Affected

2state residents only

Linked

15 filings

Confidence

66%

Full breach record for BOB'S RED MILL NATURAL FOODS, INC. →

Bob’s Red Mill Natural Foods, Inc. filed a supplemental breach notification with the New Hampshire AG regarding a ransomware attack on November 28, 2021. The incident affected 2 New Hampshire residents, exposing PII including SSNs and driver's licenses. The company secured its network, engaged forensic investigators, and offered credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 8 weeks / 57 days

Nov 28, 2021

Begins

Nov 28, 2021

Discovered

Jan 24, 2022

Filed

vs. sector median

on median

This filing is one of 15 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (10) · sorted by filing gap

Maine State AGbd_e2fee1411f242afb2022-01-19 · +5dVerified
Indiana State AGbd_e862f05ab79a3f792022-01-18 · +6dVerified
New Hampshire State AGbd_33c28cc606982e302022-01-07 · +17dVerified
Maine State AGbd_380a45d9f2b5d41e2022-01-06 · +18dVerified

Show 6 more filings ↓up to 88d gap

Maine State AGbd_03dabe7d25bc43d02022-04-12 · +78dVerified
New Hampshire State AGbd_145b8bd7a6923e072022-04-15 · +81dVerified
Montana State AGbd_933ee2b9af26142e2022-04-15 · +81dVerified
Maine State AGbd_b9fb048eefc08f012022-04-15 · +81dVerified
Massachusetts State AGbd_dcd71ea5c18373b02022-04-20 · +86dVerified
Indiana State AGbd_3a1fb212b8affff72022-04-22 · +88dVerified

Showing first 10 of 14 linked disclosures.

Name: BOB'S RED MILL NATURAL FOODS, INC.
norm: bob s red mill natural foods

Name: BOB'S RED MILL NATURAL FOODS, INC.
norm: bob s red mill natural foods
Industry: Retail & Consumerllm

Discovered: Nov 28, 2021
Breach occurred: Nov 28, 2021
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jan 4, 2022
Affected individuals: 2state-resident count only
Data types: Identity (basic)Government ID
Data elements: Social Security numberDate of birth
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for Impact
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Office of Attorney General

During the incident: Secured the network
Engaged a third-party forensic firm to investigate the incident
Notified the affected individual
Offered the affected individual complimentary credit monitoring for 12 months
Changes made: Taking steps to enhance the security of all information
Reviewing our current policies and procedures related to data protection
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 weeks(57 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 11 filings · 5 states

View merged incident ↗

Maine State AGJan 6 · first

New Hampshire State AG+1d

Indiana State AG+12d

Maine State AG+13d

New Hampshire State AG+18d · this page

Maine State AG+96d

New Hampshire State AG+99d

Montana State AG+99d

Maine State AG+99d

Massachusetts State AG+104d

Indiana State AG+106d

Pattern: first filing Jan 6 (ME), last Apr 22 (IN) — a 106-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Cascade drawn from the first 10 linked disclosures of 14 — the full spread may be wider.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/bobs-red-mill-natural-foods-20220124.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 24, 2022
Raw hash: fd9812974000c1bb7c9de051afd1cd89e61cc8dc1f012b3309591dc7710cec8d

Linked disclosures

Regulatory filings (10) · sorted by filing gap

Reporting entityBOB'S RED MILL NATURAL FOODS, INC.

Victim entityBOB'S RED MILL NATURAL FOODS, INC.

Incidentdiscovered Nov 28, 2021

Stated responseSecured the network

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov