HackingOtherStolen CredentialsCustomer Data InvolvedIdentity (basic)MediumContained

Goodwill Industries of the Southern Piedmont, Inc.

bd_e4aec0c52f7eacd3 · schema v1 · pii pii-v1

Severity

Medium

Discovered

May 11, 2022

Filed

Mar 24, 2023

To disclose

45 weeks

Affected

4,687state residents only

Linked

6 filings

Confidence

64%

Full breach record for Goodwill Industries of the Southern Piedmont, Inc. →

Goodwill Industries of the Southern Piedmont, Inc. notified South Carolina residents of unauthorized network access discovered May 11, 2022. The incident involved an unauthorized actor accessing personal information, including names and other data elements. Goodwill engaged independent cybersecurity experts, secured the network, and offered credit monitoring services.

J jump to incidentP pin to compareR raw source

South Carolina clock✓ SC CRA notice due45 weeks discovery → filing

Incident timeline

discovery → filing · 45 weeks / 317 days

May 11, 2022

Discovered

Mar 24, 2023

Filed

vs. sector median

+37 wks slower

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

New Hampshire State AGbd_02ccb65d22ef5a0b2023-03-24Verified
Montana State AGbd_3836f5bc85249ac42023-03-24Candidate
Indiana State AGbd_4bc68f98199f56842023-03-24Verified
Maine State AGbd_53d68717d43017cf2023-03-24Verified by operator

Show 1 more filing ↓

Massachusetts State AGbd_6a57b65550047b0c2023-03-24Verified

Name: Goodwill Industries of the Southern Piedmont, Inc.
norm: goodwill industries of the southern piedmont

Name: Goodwill Industries of the Southern Piedmont, Inc.
norm: goodwill industries of the southern piedmont
Industry: Otherllm

Discovered: May 11, 2022
Materiality determined: —
Notification sent: Mar 24, 2023
Affected individuals: 4,687state-resident count only
Data types: Identity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Initial access: valid_credentials

During the incident: Immediately took steps to secure the network
Engaged leading, independent cybersecurity experts to help us address the incident and conduct an investigation
Changes made: Implemented additional technical security measures
Increasing employee cybersecurity training
Offering complimentary credit monitoring and identity protection services through IDX
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 45 weeks(317 days from discovery to filing)
Compliance flags: SC CRA notice due
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

New Hampshire State AGMar 24 · first

Montana State AGMar 24 · first

Indiana State AGMar 24 · first

Maine State AGMar 24 · first

Massachusetts State AGMar 24 · first

South Carolina State AGMar 24 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2023/Goodwill.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 24, 2023
Raw hash: dae06c2e7861b5da60da3e14e63984c96a3680aa3d44ac30dd26fe5e9458358a

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityGoodwill Industries of the Southern Piedmont, Inc.

Victim entityGoodwill Industries of the Southern Piedmont, Inc.

Incidentdiscovered May 11, 2022

Stated responseImmediately took steps to secure the network

ComplianceSC CRA notice due

Extraction provenanceno artifact recorded

Source provenanceconsumer.sc.gov