MalwareTechnologyTransportation & LogisticsInformationRansomwareData EncryptedEmployee Data InvolvedFinancial accountHealth (basic)Identity (basic)Government IDPHIPIIHighActive

Cardinal Logistics Management Corp.

bd_e74aee4c1a224dd2 · schema v1 · pii pii-v1

Severity

High

Discovered

Oct 20, 2020

Filed

Mar 2, 2021

To disclose

19 weeks

Affected

1,308state residents only

Linked

9 filings

Confidence

70%

Full breach record for Cardinal Logistics Management Corp. →

Cardinal Logistics Management Corp. notified Washington AG of a ransomware attack discovered on Oct 20, 2020, affecting 1,308 WA residents. Employee PII (SSN, DOB, financial/health data) was potentially accessed. Investigation concluded Feb 9, 2021. Notices sent March 2, 2021. Credit monitoring offered.

J jump to incidentP pin to compareR raw source

Washington clock✗ WA AG >90d19 weeks discovery → filing

⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Incident timeline

discovery → filing · 19 weeks / 133 days

Oct 20, 2020

Begins

Oct 20, 2020

Discovered

Mar 2, 2021

Filed

vs. sector median

+8 wks slower

This filing is one of 9 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (8) · sorted by filing gap

Oregon State AGbd_1a17d74a4d4210a72021-03-02Candidate
Indiana State AGbd_256228e537ccbe2e2021-03-02Verified
Massachusetts State AGbd_31a3ca05d6de9db22021-03-02Verified
Montana State AGbd_bce9b51fb24a01892021-03-02Verified

Show 4 more filings ↓up to 60d gap

California State AGbd_ce279121db2d821e2021-03-02Verified
Maine State AGbd_e6772ee799add6c62021-03-02Verified
New Hampshire State AGbd_6a07fdb27af03c112021-03-15 · +13dVerified
Illinois State AGbd_f9403584bede34842021-01-01 · +60dVerified

Name: Mullen Coughlin LLC
norm: mullen coughlin

Name: Cardinal Logistics Management Corp.
norm: cardinal logistics management
Domain: cardlog.com
Industry: TechnologyllmTransportation & Logisticsllm

Discovered: Oct 20, 2020
Breach occurred: Oct 20, 2020
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Mar 2, 2021
Affected individuals: 1,308state-resident count only
Data types: Financial accountHealth (basic)Identity (basic)Government IDPHIPII
Data elements: NameSocial Security numberFinancial account numberDate of birthHealth insurance IDMedical information
WA-stated cause: Cyberattack
WA-stated duration: lifecycle Unknowndexposure Unknownd
WA-stated discovery: Found after the fact
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1078 Valid Accounts
Threat actor: ExternalFinancial

During the incident: Launched an investigation of the incident
Provided access to credit monitoring services for one (1) year, through TransUnion
Providing impacted individuals with guidance on how to better protect against identity theft and fraud
Working to implement additional safeguards and training to its employees
Changes made: Implement additional safeguards and training to its employees
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 19 weeks(133 days from discovery to filing)
Compliance flags: WA AG >90d
Discovery-date grounding: occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 9 filings · 9 states

View merged incident ↗

Illinois State AGJan 1 · first

Oregon State AG+60d

Indiana State AG+60d

Massachusetts State AG+60d

Montana State AG+60d

California State AG+60d

Maine State AG+60d

Washington State AG+60d · this page

New Hampshire State AG+73d

Pattern: first filing Jan 1 (IL), last Mar 15 (NH) — a 73-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10411.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 2, 2021
Raw hash: d0c8c98ee2c7f06cc4da190edc81e6ecb9abdafa2ae3cf6a250dd9fe4aa2cac1

Linked disclosures

Regulatory filings (8) · sorted by filing gap

Reporting entityMullen Coughlin LLC

Victim entityCardinal Logistics Management Corp.

Incidentdiscovered Oct 20, 2020

Stated responseLaunched an investigation of the incident

ComplianceWA AG >90d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com