HackingTransportation & LogisticsTransportationData ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDFinancial accountHealth (basic)PIIMediumContained

Columbia Helicopters, Inc.

bd_dafe7527a49bba83 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jul 15, 2021

Filed

Aug 24, 2021

To disclose

6 weeks

Affected

44state residents only

Linked

6 filings

Confidence

64%

Full breach record for Columbia Helicopters, Inc. →

Columbia Helicopters, Inc. notified Montana residents of a cybersecurity incident discovered on July 15, 2021. Unauthorized access occurred between May 27 and July 16, 2021, potentially exposing personal information including names, SSNs, financial account numbers, driver's license numbers, and medical/health insurance data. The company secured the network, reset passwords, notified federal law enforcement, and offered credit monitoring services.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 49 days

discovery → filing · 6 weeks / 40 days

May 27, 2021

Begins

Jul 15, 2021

Discovered

Aug 24, 2021

Filed

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Oregon State AGbd_098980ccc03a449a2021-08-24Candidate
Massachusetts State AGbd_661957da4bcc99312021-08-24Verified
Indiana State AGbd_9a737daf71a6f27b2021-08-24Verified
Maine State AGbd_f76bf4fa8ccb12802021-08-24Verified

Show 1 more filing ↓up to 6d gap

New Hampshire State AGbd_8ab106876d7e24b42021-08-30 · +6dVerified

Name: Columbia Helicopters, Inc.
norm: columbia helicopters

Name: Columbia Helicopters, Inc.
norm: columbia helicopters
Industry: Transportation & Logisticsllm

Discovered: Jul 15, 2021
Breach occurred: May 27, 2021 – Jul 16, 2021
Undetected for: 49 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 44state-resident count only
Data types: Identity (basic)Government IDFinancial accountHealth (basic)PII
Data elements: Social Security numberMedical information
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: notified federal law enforcement

During the incident: Moved quickly to secure the network
Began an investigation to identify what happened and confirm what information may have been affected
Resetting relevant account passwords
Reviewing the contents of the potentially accessed files and folders to determine whether they contained protected information
Reviewing internal systems to identify contact information for purposes of providing notice to potentially affected individuals
Notified federal law enforcement
Offering you access to complimentary credit monitoring and identity protection services for <<CL Length>> months through Epiq’s Equifax product
Changes made: Reviewing and enhancing existing policies and procedures to reduce the likelihood of a similar future event
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 weeks(40 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

Oregon State AGAug 24 · first

Massachusetts State AGAug 24 · first

Indiana State AGAug 24 · first

Maine State AGAug 24 · first

Montana State AGAug 24 · first · this page

New Hampshire State AG+6d

Pattern: first filing Aug 24 (OR), last Aug 30 (NH) — a 6-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/notificationLetter-79.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 24, 2021
Raw hash: e4f2387a5aaf2784f44da356dc0aff8a5d810b5c6820c65baa96996db1a66f8e

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityColumbia Helicopters, Inc.

Victim entityColumbia Helicopters, Inc.

Incidentdiscovered Jul 15, 2021

Stated responseMoved quickly to secure the network

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov