MalwareManufacturingManufacturingRansomwareData EncryptedTargetedFinancial accountHealth (basic)Identity (basic)Government IDPHIMediumContained

ASARCO LLC

bd_cf61ab0eed5238b5 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Mar 1, 2021

Filed

Jun 2, 2021

To disclose

13 weeks

Affected

670state residents only

Linked

7 filings

Confidence

71%

Full breach record for ASARCO LLC →

Asarco LLC reported a ransomware attack on March 1, 2021, which encrypted servers in the US and Mexico. Forensic investigation later confirmed compromise of personal information including names, SSNs, driver's license numbers, financial account info, and health insurance policy numbers for approximately 670 Washington residents. Notices were sent on June 2, 2021.

J jump to incidentP pin to compareR raw source

Washington clock✗ WA AG >90d13 weeks discovery → filing

⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Incident timeline

discovery → filing · 13 weeks / 93 days

Mar 1, 2021

Begins

Mar 1, 2021

Discovered

Jun 2, 2021

Filed

vs. sector median

+3 wks slower

This filing is one of 7 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (6) · sorted by filing gap

Maine State AGbd_141271ebdf6d56532021-07-16 · +44dVerified
New Hampshire State AGbd_16581bbcb4448d992021-07-16 · +44dVerified
Montana State AGbd_49cfe1f19d35c4542021-07-16 · +44dVerified
Massachusetts State AGbd_adc3afb1fcab8e332021-07-16 · +44dVerified

Show 2 more filings ↓up to 213d gap

Indiana State AGbd_d6cc1dff8d7fe90c2021-07-16 · +44dVerified
Illinois State AGbd_565d7d5115d918122022-01-01 · +213dVerified

Name: ASARCO LLC
norm: asarco

Name: ASARCO LLC
norm: asarco
Industry: Manufacturingllm

Discovered: Mar 1, 2021
Breach occurred: Mar 1, 2021
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jun 2, 2021
Affected individuals: 670state-resident count only
Data types: Financial accountHealth (basic)Identity (basic)Government IDPHI
Data elements: NameSocial Security numberDriver's licence numberFinancial account numberDate of birthHealth insurance ID
WA-stated cause: Cyberattack
WA-stated duration: lifecycle 0dexposure 0d
WA-stated discovery: Found while ongoingContained same day
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1190 Exploit Public-Facing Application
Threat actor: ExternalFinancial
Regulator citations: Notified Washington Office of the Attorney General
Initial access: exploit_public_facing

During the incident: Disconnected its servers
Deactivated the access point used to deploy the malicious program
Isolated the Data Center
Engaged outside cybersecurity experts to conduct a forensic investigation
Engaged a leading cybersecurity firm to analyze the malware and monitor the dark web
Sent notification letters to affected individuals
Changes made: Made enhancements to internal security systems
Implemented additional procedures to mitigate future risk
Arranged for NortonLifeLock to protect identity and monitor credit for 12 months at no cost
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 13 weeks(93 days from discovery to filing)
Compliance flags: WA AG >90d
Discovery-date grounding: occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 7 filings · 7 states

View merged incident ↗

Washington State AGJun 2 · first · this page

Maine State AG+44d

New Hampshire State AG+44d

Montana State AG+44d

Massachusetts State AG+44d

Indiana State AG+44d

Illinois State AG+213d

Pattern: first filing Jun 2 (WA), last Jan 1 (IL) — a 213-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10478.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 2, 2021
Raw hash: fccd5dd9bce22b9a06a94e4683f0d88da32dfaf13bb1e43723d37cb9c3be0050

Linked disclosures

Regulatory filings (6) · sorted by filing gap

Reporting entityASARCO LLC

Victim entityASARCO LLC

Incidentdiscovered Mar 1, 2021

Stated responseDisconnected its servers

ComplianceWA AG >90d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com