HackingTransportation & LogisticsTransportationBrute ForceStolen CredentialsCapture Stored DataTargetedCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDFinancial accountHealth (basic)HighContained

Bruckner's Truck & Equipment

bd_c7c5ad0743613066 · schema v1 · pii pii-v1

Severity

High

Discovered

May 21, 2025

Filed

Jul 9, 2025

To disclose

7 weeks

Affected · nationwide

4,4582 in this filing

Linked

5 filings

Confidence

66%

Full breach record for Bruckner's Truck & Equipment →3 incidents on file

Bruckner's Truck & Equipment reported a data breach occurring on May 20, 2025, where a bad actor used a brute force attack on a VPN account to access an employee database. The breach was discovered on May 21, 2025, and access was eliminated the same day. Compromised data included names, SSNs, government IDs, health insurance info, and DOB for 4,458 individuals. The company engaged cybersecurity experts, notified law enforcement, rebuilt its security infrastructure, and migrated to a cloud system with MFA. LifeLock services were offered to affected individuals.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered May 21, 2025 → Filed with AG Jul 9, 202549d ⏱ ME AG >30d7 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 1 days

discovery → filing · 7 weeks / 49 days

May 20, 2025

Begins

May 21, 2025

Discovered

Jul 9, 2025

Filed

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Siteqilinbd_1fb4a91487a2a56b2025-05-20 · +50dVerified by operator

Regulatory filings (3) · sorted by filing gap

Montana State AGbd_9057810182689b692025-07-09Candidate
Indiana State AGbd_8104f2a79be4c91a2025-07-11 · +2dVerified
Texas State AGbd_ca255e609b4a85a62025-07-18 · +9dVerified

Name: Bruckner's Truck & Equipment
norm: bruckner s truck equipment
Domain: brucknertruck.com

Name: Bruckner's Truck & Equipment
norm: bruckner s truck equipment
Domain: brucknertruck.com
Industry: Transportation & Logisticsllm

Discovered: May 21, 2025
Breach occurred: May 20, 2025
Undetected for: 1 dayoccurrence → discovery
Materiality determined: —
Notification sent: Jul 9, 2025
Affected individuals: 4,458state + nationwide
Data types: Identity (basic)Government IDFinancial accountHealth (basic)
Data elements: Social Security number
Attack vector: Unauthorized Access
MITRE ATT&CK: T1110 Brute ForceT1078 Valid AccountsT1119 Automated Collection
Threat actor: ExternalFinancial
Regulator citations: Filed notification with Maine Attorney General
Initial access: valid_credentials

During the incident: Engaged cybersecurity experts to ensure threat was neutralized
Notified law enforcement
Eliminated bad actor's access to the database
Changes made: Rebuilt information security infrastructure
Migrated all electronic data to a cloud-based system
Changed the way data of current and former employees is stored
Added new security safeguards
Migrated all employee access to systems requiring heightened password complexity and two-factor identification
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 7 weeks(49 days from discovery to filing)
Compliance flags: ME AG >30d · 49dLeak >30d
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: May 21, 2025
→ Filed with AG: Jul 9, 2025
49d 30 days (soft) ME AG >30d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: May 21, 2025 → Filed with AG: Jul 9, 2025	49d	30 days (soft)	ME AG >30d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Montana State AGJul 9 · first

Maine State AGJul 9 · first · this page

Indiana State AG+2d

Texas State AG+9d

Pattern: first filing Jul 9 (MT), last Jul 18 (TX) — a 9-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/2a93b6a1-7f1c-4ed2-969d-189dfeb5b0bb.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 9, 2025
Raw hash: 41b947dad6435ca3fe30f55ab3400de1ee1d2ed2fc093002186216c345e2a87e

Linked disclosures

Ransomware claims (1)

Regulatory filings (3) · sorted by filing gap

Reporting entityBruckner's Truck & Equipment

Victim entityBruckner's Truck & Equipment

Incidentdiscovered May 21, 2025

Stated responseEngaged cybersecurity experts to ensure threat was neutralized

ComplianceME AG >30d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov