Kretek International
bd_d05662c5e17462cb · schema v1 · pii pii-v1
Full breach record for Kretek International →Threat-actor claim — not a regulatory filing
This row is a claim by the ransomware group BlackSuit (formerly Royal) on its public extortion blog. It has not been validated by the victim or any regulator. Treat attribution and counts as the threat actor's assertion until a regulatory filing or victim disclosure corroborates them.
Source: Ransomware.live
Post text · scraped from the leak site
Kretek International, Inc is a number one importer, marketer, and distributor of specialty tobacco products to convenience, mass, and national retailers in the US. We are going to distribute the data of 70GB size we got from them. We have accounting, finance data, payment information, contracts, personal information (employees' info, addresses etc.), information about their projects and so on.Release coming soon.
J jump to incidentP pin to compareR raw source
Incident timeline — mostly unverified
? — ?
Breach window unknown
Apr 5, 2023
Claim posted
—
Corroborated · see linked filings
Compliance clocks stay unassessable until a regulatory filing lands. Dashed segments fill in automatically when corroboration arrives.
Claim → filing
—
Compliance clock
Not assessable
Linked disclosures
Why this link?Regulatory filings (2) · sorted by filing gap
- Indiana State AGbd_b3e258e4548a6ec22023-06-07 · +63dVerified
- Massachusetts State AGbd_e2fe9091636672692023-06-07 · +63dVerified by operator
Filing propagation · 3 filings · 2 states
View merged incident ↗Pattern: first filing Apr 5, last Jun 7 (MA) — a 63-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?
Evidence ladder
Attacker assertion only. Establishes: claim date, group, alleged victim.
Unlocks: incident narrative, operational impact. Still no compliance clock.
Unlocks: discovery date, data types, affected count, compliance clock.
Unlocks: materiality, stated response, full audit trail. Ceiling removed.
Source ceiling
- actor name
- victim claim
- ransom/leak status
- discovery date
- materiality
- notification
- affected count
- confirmed data types
- compliance clock
The ✕ fields stay blank until a regulatory filing or victim disclosure lands.
blacksuit
According to ransomware.live, According to Trend Micro, this ransomware has significant code overlap with Royal Ransomware.