HackingManufacturingManufacturingSupply Chain (3P Vendor)Customer Data InvolvedIdentity (basic)CredentialsLowActive

Iscar Metal

bd_c28ef84670580b55 · schema v1 · pii pii-v1

Severity

Low

Discovered

Nov 16, 2023

Filed

Dec 6, 2023

To disclose

20 days

Affected

Not disclosed

Linked

2 filings

Confidence

66%

Full breach record for Iscar Metal →

Iscar Metal notified Vermont AG on 2023-12-06 regarding a third-party data breach involving SignatureIT Ltd., its e-commerce platform provider. On 2023-11-16, SignatureIT noticed unusual activity on its network; forensic experts identified its Confluence platform as the probable penetration point. Iscar's internal systems were unaffected, but customer data (names, addresses, passwords, transaction details) stored on SignatureIT servers may have been accessed. Iscar notified the FBI, CISA, state regulators, and EU authorities. No specific count of affected individuals was provided.

J jump to incidentP pin to compareR raw source

Vermont clock✓ VT AG ≤14 bday20 days discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

discovery → filing · 20 days

Nov 16, 2023

Discovered

Dec 6, 2023

Filed

vs. sector median

8 wks faster

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Maine State AGbd_b7805fd4f38eaa582023-12-15 · +9dVerified

Name: Iscar Metal
norm: iscar metal

Name: Iscar Metal
norm: iscar metal
Industry: Manufacturingllm

Discovered: Nov 16, 2023
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: Identity (basic)Credentials
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain Compromise
Threat actor: External
Regulator citations: Notified the U.S. Federal Bureau of InvestigationNotified the Cybersecurity and Infrastructure Security Agency under the Cyber Incident Reporting for Critical Infrastructure ActNotified applicable U.S. state agenciesNotified the E.U. under the General Data Protection Regulation
Third party: via SignatureIT Ltd.
Initial access: supply_chain

During the incident: Notifications were sent to relevant regulators
Notifications sent to the U.S. Federal Bureau of Investigation
Notifications sent to the Cybersecurity and Infrastructure Security Agency under the Cyber Incident Reporting for Critical Infrastructure Act
Notifications sent to applicable U.S. state agencies
Notifications sent to the E.U. under the General Data Protection Regulation
E-commerce platforms were shut down
Working to restore a secure e-commerce platform
Continuing to monitor the incident and its effect on the customer community
Changes made: Recommending customers change passwords for accounts using the same or similar password
Recommending customers monitor online accounts and review credit reports for suspicious activity
Recommending customers report suspected identity theft to local law enforcement or Attorney General’s Office
Recommending customers contact credit bureaus to place a fraud alert on their accounts
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 20 days(20 days from discovery to filing)
Compliance flags: VT AG ≤14 bday
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Vermont State AGDec 6 · first · this page

Maine State AG+9d

Pattern: first filing Dec 6 (VT), last Dec 15 (ME) — a 9-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ago.vermont.gov/document/2023-12-06-iscar-metal-data-breach-notice-consumers
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 6, 2023
Raw hash: bf30489331ad3a50e39db986760fa029dfe8fffa961f1296302327c12095813b

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityIscar Metal

Victim entityIscar Metal

Incidentdiscovered Nov 16, 2023

Stated responseNotifications were sent to relevant regulators

ComplianceVT AG ≤14 bday

Extraction provenanceno artifact recorded

Source provenanceago.vermont.gov