HackingManufacturingTechnologyManufacturingStolen CredentialsSupply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedPIIIdentity (basic)LowActive

CMT Industrial Solutions

bd_ca5dc2690f03340e · schema v1 · pii pii-v1

Severity

Low

Discovered

—

Filed

Dec 14, 2023

To disclose

—

Affected

1state residents only

Confidence

65%

Full breach record for CMT Industrial Solutions →2 incidents on file

CMT Industrial Solutions, LLC voluntarily notified the New Hampshire Attorney General of a third-party data breach involving SignatureIT Ltd., an e-commerce platform provider. On November 16, 2023, SignatureIT detected unauthorized access to its Confluence collaboration platform, potentially exposing customer personal information. CMT notified approximately one Maryland resident and relevant regulators, including the FBI and CISA, on December 6, 2023. CMT's own systems were not directly accessed.

J jump to incidentP pin to compareR raw source

Incident timeline

Nov 16, 2023

Begins

Dec 14, 2023

Filed

Part of SignatureIT Ltd. supply-chain incident (2023) — a supply-chain cascade affecting multiple organizations.View cascade →

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed1 affectedView incident

Name: CMT Industrial Solutions
norm: cmt industrial
Domain: cmtindustrial.com

Name: CMT Industrial Solutions
norm: cmt industrial
Domain: cmtindustrial.com
Industry: ManufacturingllmTechnologyllm

Discovered: —
Breach occurred: Nov 16, 2023
Materiality determined: —
Notification sent: Dec 6, 2023
Affected individuals: 1state-resident count only
Data types: PIIIdentity (basic)
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: External
Regulator citations: Notified the U.S. Federal Bureau of InvestigationNotified the Cybersecurity and Infrastructure Security Agency under the Cyber Incident Reporting for Critical Infrastructure ActNotified applicable U.S. state agenciesNotified the E.U. under the General Data Protection RegulationNotified the nationwide consumer reporting agencies
Third party: via SignatureIT Ltd.
Initial access: exploit_public_facing

During the incident: Notified all known U.S. users registered with the e-commerce platform on or before November 16, 2023
Provided notice electronically to said users on or about December 6, 2023
Sent notifications to relevant regulators including the U.S. Federal Bureau of Investigation
Notified the Cybersecurity and Infrastructure Security Agency under the Cyber Incident Reporting for Critical Infrastructure Act
Notified applicable U.S. state agencies
Notified the E.U. under the General Data Protection Regulation
Notified the nationwide consumer reporting agencies
Changes made: Continues to monitor this incident and its effect on its customer community
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/cmt-industrial-solutions-20231214.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 14, 2023
Raw hash: eb5613fac6c54ad78258065391b96c86b4807c1883b4ef565a5d11e4a13deaaa

Reporting entityCMT Industrial Solutions

Victim entityCMT Industrial Solutions

IncidentThird-Party / Supply Chain

Stated responseNotified all known U.S. users registered with the e-commerce platform on or before November 16, 2023

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov