MalwareRetail & ConsumerRetailRansomwareData ExfiltratedData EncryptedCustomer Data InvolvedIdentity (basic)LowContained

3T Brands

bd_f5a0dda0a7efdacc · schema v1 · pii pii-v1

Severity

Low

Discovered

Aug 11, 2021

Filed

May 26, 2022

To disclose

41 weeks

Affected

1state residents only

Linked

3 filings

Confidence

65%

Full breach record for 3T Brands →

3T Brands, Inc. reported a data security incident to the New Hampshire Attorney General on May 26, 2022. The incident involved unauthorized access to systems from August 8-11, 2021, resulting in the encryption of data (ransomware) and potential exfiltration of personal information. One New Hampshire resident was affected. The company engaged forensic investigators, notified the FBI, and provided identity theft protection services to the affected individual.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 3 days

discovery → filing · 41 weeks / 288 days

Aug 8, 2021

Begins

Aug 11, 2021

Discovered

May 26, 2022

Filed

vs. sector median

+32 wks slower

This filing is one of 3 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Maine State AGbd_2c6146552cac2dbe2022-05-26Candidate
Massachusetts State AGbd_94326045425319fd2022-05-26Verified

Name: 3T Brands
norm: 3t brands

Name: 3T Brands
norm: 3t brands
Industry: Retail & Consumerllm

Discovered: Aug 11, 2021
Breach occurred: Aug 8, 2021 – Aug 11, 2021
Undetected for: 3 daysoccurrence → discovery
Materiality determined: —
Notification sent: May 26, 2022
Affected individuals: 1state-resident count only
Data types: Identity (basic)
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1119 Automated Collection
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Attorney General

During the incident: Engaged a digital forensics firm to help determine what happened and what information may have been accessed
Notified the FBI about the incident
Engaged independent experts to review of the data that could have potentially been accessed
Notified law enforcement
Implemented additional safeguards to help ensure the security of our network
Changes made: Working with leading cybersecurity experts to enhance the security of its digital environment
Offering you identity theft protection services through IDX
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 41 weeks(288 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Maine State AGMay 26 · first

Massachusetts State AGMay 26 · first

New Hampshire State AGMay 26 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/3t-brands-20220526.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 26, 2022
Raw hash: fd5bbd65e71854fe1d19828f13570d168f931b3b50128b0c4fb9c2c20c4e7da8

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entity3T Brands

Victim entity3T Brands

Incidentdiscovered Aug 11, 2021

Stated responseEngaged a digital forensics firm to help determine what happened and what information may have been accessed

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov