HackingProfessional ServicesProfessional ServicesStolen CredentialsSupply Chain (3P Vendor)Customer Data InvolvedIdentity (basic)Financial accountLowActive

Deep Foundations Institute, Inc.

bd_dcb59a2c0800c082 · schema v1 · pii pii-v1

Severity

Low

Discovered

Apr 27, 2022

Filed

May 24, 2022

To disclose

27 days

Affected

2state residents only

Linked

6 filings

Confidence

64%

Full breach record for Deep Foundations Institute, Inc. →

Deep Foundations Institute, Inc. notified members of a third-party vendor incident discovered on April 27, 2022. The vendor, which hosts DFI's membership and payment software, found suspicious code intended to capture credit/debit card data. DFI is offering credit monitoring. The incident is ongoing.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 27 days

Apr 27, 2022

Discovered

May 24, 2022

Filed

vs. sector median

15 wks faster

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Indiana State AGbd_cbb330c799787c1b2022-05-24Verified
Maine State AGbd_4a39a31bba8b12462022-05-25 · +1dVerified by operator
Massachusetts State AGbd_a434b5e78ed27e402022-05-25 · +1dVerified
New Hampshire State AGbd_b3dc16085b2fcb4c2022-05-31 · +7dVerified

Show 1 more filing ↓up to 8d gap

Maine State AGbd_32c60d07c596f78c2022-05-16 · +8dCandidate

Name: Deep Foundations Institute, Inc.
norm: deep foundations institute

Name: Deep Foundations Institute, Inc.
norm: deep foundations institute
Industry: Professional Servicesllm

Discovered: Apr 27, 2022
Materiality determined: —
Notification sent: May 24, 2022
Affected individuals: 2state-resident count only
Data types: Identity (basic)Financial account
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain CompromiseT1056 Input Capture
Threat actor: ExternalFinancial
Initial access: supply_chain

During the incident: Requested additional information from the organization
Requested a full list of potentially impacted members
Began working with the impacted organization in order to notify potentially impacted individuals
Offering a complimentary membership of Experian’s IdentityWorks
Changes made: Vendor implemented additional security measures to prevent similar occurrences
Vendor ensured payment collection software was safe to use
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 27 days(27 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 5 states

View merged incident ↗

Maine State AGMay 16 · first

Indiana State AG+8d

Montana State AG+8d · this page

Maine State AG+9d

Massachusetts State AG+9d

New Hampshire State AG+15d

Pattern: first filing May 16 (ME), last May 31 (NH) — a 15-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-Notification-Letter-437.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 24, 2022
Raw hash: 6f4351addc34829855b6bb88a4b642a8f906f70f6861e6b31bab5d08692025ea

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityDeep Foundations Institute, Inc.

Victim entityDeep Foundations Institute, Inc.

Incidentdiscovered Apr 27, 2022

Stated responseRequested additional information from the organization

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov