HackingAgriculture & FoodAgricultureStolen CredentialsCustomer Data InvolvedEmployee Data InvolvedGovernment IDIdentity (basic)MediumContained

DELICATO VINEYARDS

bd_c896f83971d06bbd · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jun 1, 2018

Filed

Aug 17, 2018

To disclose

11 weeks

Affected

2state residents only

Linked

3 filings

Confidence

65%

Full breach record for DELICATO VINEYARDS →3 incidents on file

Delicato Vineyards notified the NH AG of a potential data breach involving 2 NH residents. Unauthorized access to the VINES (SAP SuccessFactors) system occurred in April 2018, discovered in June 2018. Data included names and SSNs. Delicato changed credentials and offered 24 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 61 days

discovery → filing · 11 weeks / 77 days

Apr 1, 2018

Begins

Jun 1, 2018

Discovered

Aug 17, 2018

Filed

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Massachusetts State AGbd_223c8df106626ddf2018-08-14 · +3dVerified
California State AGbd_daee68abd97f8e3f2018-08-14 · +3dCandidate

Name: DELICATO VINEYARDS
norm: delicato vineyards
Domain: delicato.com
Industry: Agriculture/Food

Name: DELICATO VINEYARDS
norm: delicato vineyards
Domain: delicato.com
Industry: Agriculture/Food
Industry: Agriculture & Foodllm

Discovered: Jun 1, 2018
Breach occurred: Apr 1, 2018 – Apr 30, 2018
Undetected for: 61 daysoccurrence → discovery
Materiality determined: —
Notification sent: Aug 15, 2018
Affected individuals: 2state-resident count only
Data types: Government IDIdentity (basic)
Data elements: Social Security number
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: Notified New Hampshire Attorney General
Initial access: valid_credentials

During the incident: Changed the VINES credentials so that outside parties can no longer access the information
Conducted, and is continuing to conduct, a thorough review of the potentially affected records
Changes made: Offering potentially affected individuals 24 months of identity theft repair, fraud alerts and credit monitoring
Reimbursing potential affected individuals for implementing a security freeze
Increased alerts for events including account lockouts, impossible (concurrent) logins and access from unfamiliar networks
Implementing increased security measures designed to protect the personal information of current and former employees and third parties
Implementing a two-factor authentication process for certain users and access situations
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 11 weeks(77 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Massachusetts State AGAug 14 · first

California State AGAug 14 · first

New Hampshire State AG+3d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/delicato-vineyards-20180817.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 17, 2018
Raw hash: ad77058b105134ca9056c7a87325860ecdce7dda76aeba99ecae06d4d9e53ac2

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityDELICATO VINEYARDS

Victim entityDELICATO VINEYARDS

Incidentdiscovered Jun 1, 2018

Stated responseChanged the VINES credentials so that outside parties can no longer access the information

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov