HackingTechnologyInformationStolen CredentialsCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDMediumActive

Epson Portland

bd_d51243ef2a1d0b4e · schema v1 · pii pii-v1

Severity

Medium

Discovered

Apr 29, 2022

Filed

Jun 13, 2022

To disclose

6 weeks

Affected

8state residents only

Confidence

66%

Epson Portland (EPI), an affiliate of Epson America Inc., experienced a network security incident discovered on April 29, 2022. The incident potentially compromised PII including names and SSNs of employees and customers. EPI retained forensic investigators and offered 24 months of credit monitoring. Investigation was ongoing at the time of filing.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 6 weeks / 45 days

Apr 29, 2022

Discovered

Jun 13, 2022

Filed

vs. sector median

12 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed8 affectedView incident

Name: Epson America Inc.
norm: epson america
Domain: epson.com

Name: Epson Portland
norm: epson portland
Domain: epson.com
Industry: Technologyllm

Discovered: Apr 29, 2022
Materiality determined: —
Notification sent: —
Affected individuals: 8state-resident count only
Data types: Identity (basic)Government ID
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: Notified the FBI
Initial access: valid_credentials

During the incident: Retained an IT firm to conduct a thorough forensic investigation
Took steps to contain the incident
Eliminating the vulnerability that was used by the unauthorized actor
Implementing additional security measures
Arranged to have Cyberscout provide you with twenty-four (24) months of complimentary credit monitoring services through Identity Force and identity theft insurance
Changes made: Eliminating the vulnerability that was used by the unauthorized actor
Implementing additional security measures
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 weeks(45 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-Notification-Letter-44.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 13, 2022
Raw hash: f54407ff8026882b45b87cb6515673ddec1c4607dd28633c9cc39792ec70a322

Reporting entityEpson America Inc.

Victim entityEpson Portland

Incidentdiscovered Apr 29, 2022

Stated responseRetained an IT firm to conduct a thorough forensic investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov