HackingAgriculture & FoodAgricultureStolen CredentialsData ExfiltratedDelayed DiscoveryIdentity (basic)Government IDMediumContained

Gavilon Grain, LLC

bd_e3fff5e2e409f7c9 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Aug 2, 2019

Filed

Aug 30, 2019

To disclose

28 days

Affected

9state residents only

Confidence

65%

Gavilon Grain, LLC notified Montana residents of a data breach involving an unencrypted Excel spreadsheet containing names and SSNs. The data was posted on a third-party vendor's (Cultura) unsecured FTP server from December 2015 until August 2, 2019. Gavilon discovered the incident on August 2, 2019, when the file was removed. No direct evidence of unauthorized access was found, but the data was potentially accessible. Gavilon offered one year of Experian IdentityWorks.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 1340 days

discovery → filing · 28 days

Dec 1, 2015

Begins

Aug 2, 2019

Discovered

Aug 30, 2019

Filed

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed9 affectedView incident

Name: Gavilon Grain, LLC
norm: gavilon grain

Name: Gavilon Grain, LLC
norm: gavilon grain
Industry: Agriculture & Foodllm

Discovered: Aug 2, 2019
Breach occurred: Dec 1, 2015 – Aug 2, 2019
Undetected for: 1,340 daysoccurrence → discovery
Materiality determined: —
Notification sent: Aug 30, 2019
Affected individuals: 9state-resident count only
Data types: Identity (basic)Government ID
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1041 Exfiltration Over C2 ChannelT1119 Automated Collection
Threat actor: External
Third party: via Cultura
Initial access: trusted_relationship

During the incident: Confirmed with Cultura that the spreadsheet is no longer accessible
Worked to insure policies are in place to guard against any similar incident
Offering a complimentary one-year membership of Experian’s IdentityWorks
Changes made: Worked to insure policies are in place to guard against any similar incident in the future
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 28 days(28 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-12.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 30, 2019
Raw hash: 3b2f1949da658d65ff60d87e993bf3d0555c47831c0161a2b4babdeb57f832d1

Reporting entityGavilon Grain, LLC

Victim entityGavilon Grain, LLC

Incidentdiscovered Aug 2, 2019

Stated responseConfirmed with Cultura that the spreadsheet is no longer accessible

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov