MalwareRetail & ConsumerRetailRansomwareCapture Stored DataData ExfiltratedData EncryptedRansom DemandedIdentity (basic)Government IDMediumContained

LEWIS BROTHERS BAKERIES INCORPORATED

bd_c751dcd23ab272c5 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Apr 1, 2024

Filed

May 9, 2024

To disclose

5 weeks

Affected

1state residents only

Linked

7 filings

Confidence

62%

Full breach record for LEWIS BROTHERS BAKERIES INCORPORATED →

Lewis Brothers Bakeries, Inc. notified Montana residents of a cybersecurity incident discovered on April 1, 2024. Unauthorized access occurred between March 25 and April 1, 2024, resulting in the encryption of files and exfiltration of personal data including names and Social Security numbers. The company engaged forensic specialists, notified law enforcement, and offered 12 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 7 days

discovery → filing · 5 weeks / 38 days

Mar 25, 2024

Begins

Apr 1, 2024

Discovered

May 9, 2024

Filed

vs. sector median

2 wks faster

This filing is one of 7 about the same incident.View merged incident

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Sitemedusabd_5d5461a06b0e9e872024-04-30 · +8dVerified by operator

Regulatory filings (5) · sorted by filing gap

Indiana State AGbd_39807d887f1806592024-05-09Verified
New Hampshire State AGbd_5c100b937d8d789f2024-05-09Verified
Maine State AGbd_965717f291a48c8f2024-05-09Verified
Massachusetts State AGbd_ec724d28d980c4542024-05-13 · +4dVerified

Show 1 more filing ↓up to 8d gap

Illinois State AGbd_1a5c38fd7c1e13932024-05-01 · +8dCandidate

Name: LEWIS BROTHERS BAKERIES INCORPORATED
norm: lewis brothers bakeries
Domain: lewisbakeries.net

Name: LEWIS BROTHERS BAKERIES INCORPORATED
norm: lewis brothers bakeries
Domain: lewisbakeries.net
Industry: Retail & Consumerllm

Discovered: Apr 1, 2024
Breach occurred: Mar 25, 2024 – Apr 1, 2024
Undetected for: 7 daysoccurrence → discovery
Materiality determined: —
Notification sent: May 9, 2024
Affected individuals: 1state-resident count only
Data types: Identity (basic)Government ID
Data elements: Social Security number
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial

During the incident: Launched an investigation into the nature and scope of this activity, with the assistance of third-party forensic specialists
Undertook a comprehensive review of all data that was potentially subject to unauthorized access
Notified law enforcement
Offering you complimentary access to 12 months of credit monitoring services through Experian
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 weeks(38 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

Illinois State AGMay 1 · first

Indiana State AG+8d

New Hampshire State AG+8d

Maine State AG+8d

Montana State AG+8d · this page

Massachusetts State AG+12d

Pattern: first filing May 1 (IL), last May 13 (MA) — a 12-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-notification-letter-1356.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 9, 2024
Raw hash: 067fa9610b1399534132712b9b6a1f128e162b85557581f96ab8b72f7bc22901

Linked disclosures

Ransomware claims (1)

Regulatory filings (5) · sorted by filing gap

Reporting entityLEWIS BROTHERS BAKERIES INCORPORATED

Victim entityLEWIS BROTHERS BAKERIES INCORPORATED

Incidentdiscovered Apr 1, 2024

Stated responseLaunched an investigation into the nature and scope of this activity, with the assistance of third-party forensic specialists

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov