AccidentalTransportation & LogisticsTransportationMisconfigurationCustomer Data InvolvedDelayed DiscoveryIdentity (basic)Government IDHighContained

J.B. Hunt Transport, Inc.

bd_e8cf955b53ab548e · schema v1 · pii pii-v1

Severity

High

Discovered

Jul 2, 2021

Filed

Oct 20, 2021

To disclose

16 weeks

Affected

3,787state residents only

Linked

10 filings

Confidence

71%

Full breach record for J.B. Hunt Transport, Inc. →2 incidents on file

J.B. Hunt Transport, Inc. reported a cybersecurity incident involving a configuration error in its Microsoft Power Apps portal. Unauthorized access to applicant data, including names and Social Security numbers, occurred between August 17, 2020, and July 2, 2021. The incident was discovered on July 2, 2021. Notifications were sent to 3,787 Washington residents and 511 Rhode Island residents on October 20, 2021, offering credit monitoring services.

J jump to incidentP pin to compareR raw source

Washington clock✗ WA AG >90d16 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 319 days

discovery → filing · 16 weeks / 110 days

Aug 17, 2020

Begins

Jul 2, 2021

Discovered

Oct 20, 2021

Filed

This filing is one of 10 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (9) · sorted by filing gap

New Hampshire State AGbd_59eb7fd25276ddbb2021-10-20Verified by operator
Maine State AGbd_5d821d50bd9e30cc2021-10-20Candidate
Montana State AGbd_64d097f3d0e2e9512021-10-20Verified by operator
California State AGbd_90f9ff5e002e9d732021-10-20Verified by operator

Show 5 more filings ↓up to 5d gap

Oregon State AGbd_a9556718012425c52021-10-20Candidate
South Carolina State AGbd_ba962168d53d59c02021-10-20Verified by operator
Massachusetts State AGbd_df7c6261f3db4b002021-10-20Verified by operator
Delaware State AGbd_e23585d36fb04fea2021-10-20Verified by operator
Indiana State AGbd_d3f9c7caec2128ae2021-10-15 · +5dVerified by operator

Name: J.B. Hunt Transport, Inc.
norm: jb hunt transport

Name: J.B. Hunt Transport, Inc.
norm: jb hunt transport
Industry: Transportation & Logisticsllm

Discovered: Jul 2, 2021
Breach occurred: Aug 17, 2020 – Jul 2, 2021
Undetected for: 319 daysoccurrence → discovery
Materiality determined: —
Notification sent: Oct 20, 2021
Affected individuals: 3,787state-resident count only
Data types: Identity (basic)Government ID
Data elements: NameSocial Security number
WA-stated cause: Theft or Mistake
WA-stated duration: lifecycle 300-399dexposure 300-399d
WA-stated discovery: Found while ongoingContained same day
Attack vector: Misconfiguration
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: External
Regulator citations: Notified Office of the Washington Attorney General

During the incident: Took steps to secure the portal
Completed a careful review of the data
Began mailing notification letters to 3,787 Washington residents
Offered the Washington residents complimentary one-year subscriptions to credit monitoring, fraud consultation, and identity restoration services through Experian
Established a dedicated, toll-free call center
Changes made: Reviewed permissions to access data in the cloud
Made modifications for all cloud services
Implemented other measures to help prevent unauthorized access to J.B. Hunt data
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 16 weeks(110 days from discovery to filing)
Compliance flags: WA AG >90d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 10 filings · 10 states

View merged incident ↗

Indiana State AGOct 15 · first

New Hampshire State AG+5d

Maine State AG+5d

Montana State AG+5d

California State AG+5d

Oregon State AG+5d

South Carolina State AG+5d

Massachusetts State AG+5d

Delaware State AG+5d

Washington State AG+5d · this page

Pattern: first filing Oct 15 (IN), last Oct 20 (WA) — a 5-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM11236.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 20, 2021
Raw hash: 09d6164e9e168bd842004c519c8a619792ba2ff20d4274a39ac855093ad96d26

Linked disclosures

Regulatory filings (9) · sorted by filing gap

Reporting entityJ.B. Hunt Transport, Inc.

Victim entityJ.B. Hunt Transport, Inc.

Incidentdiscovered Jul 2, 2021

Stated responseTook steps to secure the portal

ComplianceWA AG >90d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com