AccidentalTransportation & LogisticsTransportationMisconfigurationCustomer Data InvolvedDelayed DiscoveryIdentity (basic)Government IDHighContained

J.B. Hunt Transport, Inc.

bd_e8cf955b53ab548e · schema v1 · pii pii-v1

Severity

High

Discovered

Jul 2, 2021

Filed

Oct 20, 2021

To disclose

16 weeks

Affected

3,787state residents only

Linked

3 filings

Confidence

71%

Full breach record for J.B. Hunt Transport, Inc. →5 incidents on file

J.B. Hunt Transport, Inc. reported a cybersecurity incident involving a configuration error in its Microsoft Power Apps portal. Unauthorized access to applicant data, including names and Social Security numbers, occurred between August 17, 2020, and July 2, 2021. The incident was discovered on July 2, 2021. Notifications were sent to 3,787 Washington residents and 511 Rhode Island residents on October 20, 2021, offering credit monitoring services.

J jump to incidentP pin to compareR raw source

Washington clock✗ WA AG >90d16 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 319 days

discovery → filing · 16 weeks / 110 days

Aug 17, 2020

Begins

Jul 2, 2021

Discovered

Oct 20, 2021

Filed

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Maine State AGbd_5d821d50bd9e30cc2021-10-20Candidate
Oregon State AGbd_a9556718012425c52021-10-20Candidate

Name: J.B. Hunt Transport, Inc.
norm: jb hunt transport

Name: J.B. Hunt Transport, Inc.
norm: jb hunt transport
Industry: Transportation & Logisticsllm

Discovered: Jul 2, 2021
Breach occurred: Aug 17, 2020 – Jul 2, 2021
Undetected for: 319 daysoccurrence → discovery
Materiality determined: —
Notification sent: Oct 20, 2021
Affected individuals: 3,787state-resident count only
Data types: Identity (basic)Government ID
Data elements: NameSocial Security number
WA-stated cause: Theft or Mistake
WA-stated duration: lifecycle 300-399dexposure 300-399d
WA-stated discovery: Found while ongoingContained same day
Attack vector: Misconfiguration
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: External
Regulator citations: Notified Office of the Washington Attorney General

During the incident: Took steps to secure the portal
Completed a careful review of the data
Began mailing notification letters to 3,787 Washington residents
Offered the Washington residents complimentary one-year subscriptions to credit monitoring, fraud consultation, and identity restoration services through Experian
Established a dedicated, toll-free call center
Changes made: Reviewed permissions to access data in the cloud
Made modifications for all cloud services
Implemented other measures to help prevent unauthorized access to J.B. Hunt data
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 16 weeks(110 days from discovery to filing)
Compliance flags: WA AG >90d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Maine State AGOct 20 · first

Oregon State AGOct 20 · first

Washington State AGOct 20 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM11236.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 20, 2021
Raw hash: 09d6164e9e168bd842004c519c8a619792ba2ff20d4274a39ac855093ad96d26

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityJ.B. Hunt Transport, Inc.

Victim entityJ.B. Hunt Transport, Inc.

Incidentdiscovered Jul 2, 2021

Stated responseTook steps to secure the portal

ComplianceWA AG >90d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com