MalwareRetail & ConsumerRetailRansomwareCapture Stored DataData ExfiltratedRansom DemandedIdentity (basic)Government IDMediumContained

Tom James Company

bd_dec2114b968e344d · schema v1 · pii pii-v1

Severity

Medium

Discovered

Aug 1, 2022

Filed

Feb 17, 2023

To disclose

29 weeks

Affected

2state residents only

Linked

5 filings

Confidence

66%

Full breach record for Tom James Company →

Tom James Company notified affected individuals in Montana and other states of a ransomware incident in August 2022. The attack encrypted systems and an unauthorized actor claimed to have accessed files containing names and Social Security numbers. The company reported the incident to federal law enforcement, offered 12 months of credit monitoring via Experian, and enhanced security policies.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 29 weeks / 200 days

Aug 1, 2022

Begins

Aug 1, 2022

Discovered

Feb 17, 2023

Filed

vs. sector median

+19 wks slower

This filing is one of 5 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Vermont State AGbd_5f091cf4bf5858812023-02-17Verified
Maine State AGbd_60497f4ff76efd972023-02-17Candidate
Indiana State AGbd_678d9dcd02ad63462023-02-17Verified
Massachusetts State AGbd_dbf04af71d99807f2023-02-17Verified

Name: Tom James Company
norm: tom james

Name: Tom James Company
norm: tom james
Industry: Retail & Consumerllm

Discovered: Aug 1, 2022
Breach occurred: Aug 1, 2022
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Feb 17, 2023
Affected individuals: 2state-resident count only
Data types: Identity (basic)Government ID
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: reported this event to federal law enforcementnotifying relevant regulatory authorities

During the incident: Took steps to secure our network
Began an investigation to determine the nature and scope of the activity
Undertook a comprehensive review of the potentially-impacted data
Reported this event to federal law enforcement
Offering you access to credit monitoring and identity theft protection services for twelve (12) months through Experian at no cost
Changes made: Reviewing and enhancing our existing policies and procedures relating to data protection and security
Institute additional security measures
Provide additional training to employees
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 29 weeks(200 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Vermont State AGFeb 17 · first

Maine State AGFeb 17 · first

Indiana State AGFeb 17 · first

Massachusetts State AGFeb 17 · first

Montana State AGFeb 17 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-notification-letter-76.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 17, 2023
Raw hash: 4d4b9f55a5877bdcf23a3e85dd7520d79e9fe8c57aa092a15e0ba9778c058e39

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityTom James Company

Victim entityTom James Company

Incidentdiscovered Aug 1, 2022

Stated responseTook steps to secure our network

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov