HackingRetail & ConsumerRetailSupply Chain (3P Vendor)Data ExfiltratedPIIIdentity (basic)LowContained

Kibble Equipment

bd_f13fd8c9aefa1843 · schema v1 · pii pii-v1

Severity

Low

Discovered

Mar 7, 2023

Filed

Apr 10, 2023

To disclose

5 weeks

Affected

4state residents only

Linked

2 filings

Confidence

66%

Full breach record for Kibble Equipment →

Kibble Equipment notified Montana residents of a data incident involving its vendor, Razor Consulting Solutions, and Razor's sub-vendor, Rackspace Cloud Services. Unauthorized access occurred on January 12, 2023, impacting customer exemption certificates and vendor W9 forms containing personal information. Kibble confirmed the breach on March 7, 2023, and sent notifications on April 10, 2023, offering one year of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 54 days

discovery → filing · 5 weeks / 34 days

Jan 12, 2023

Begins

Mar 7, 2023

Discovered

Apr 10, 2023

Filed

vs. sector median

3 wks faster

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Indiana State AGbd_fadec5b500aafce02023-04-10Verified

Name: Kibble Equipment
norm: kibble equipment

Name: Kibble Equipment
norm: kibble equipment
Industry: Retail & Consumerllm

Discovered: Mar 7, 2023
Breach occurred: Jan 12, 2023
Undetected for: 54 daysoccurrence → discovery
Materiality determined: —
Notification sent: Apr 10, 2023
Affected individuals: 4state-resident count only
Data types: PIIIdentity (basic)
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain Compromise
Threat actor: External
Initial access: supply_chain

During the incident: Offering you a complimentary one-year membership through IDX
Working with our vendors to enhance their security measures
Changes made: Working with our vendors to enhance their security measures
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 weeks(34 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Indiana State AGApr 10 · first

Montana State AGApr 10 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-notification-letter-175.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 10, 2023
Raw hash: a21ee42bf50419e4fa06527e0ecee3939d153c2672efcc2d2d690e2d90153f3e

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityKibble Equipment

Victim entityKibble Equipment

Incidentdiscovered Mar 7, 2023

Stated responseOffering you a complimentary one-year membership through IDX

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov