HackingProfessional ServicesProfessional ServicesStolen CredentialsSupply Chain (3P Vendor)Data ExfiltratedPIIIdentity (basic)LowContained

Marking Services, Inc.

bd_f5e4a2b99ea460c6 · schema v1 · pii pii-v1

Severity

Low

Discovered

Jun 26, 2021

Filed

Mar 12, 2022

To disclose

37 weeks

Affected

2state residents only

Linked

3 filings

Confidence

66%

Full breach record for Marking Services, Inc. →

Marking Services, Inc. notified Montana residents of a security incident where unauthorized access occurred between June 11 and June 26, 2021. The attacker used stolen credentials from a third-party IT provider. Full names and potentially other PII were accessed. The company reset passwords, implemented MFA, and offered one year of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 15 days

discovery → filing · 37 weeks / 259 days

Jun 11, 2021

Begins

Jun 26, 2021

Discovered

Mar 12, 2022

Filed

vs. sector median

+18 wks slower

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Maine State AGbd_115e42c8dd4276252022-03-12Candidate
Indiana State AGbd_610b90b13ad53b5b2022-03-11 · +1dVerified

Name: Marking Services, Inc.
norm: marking services

Name: Marking Services, Inc.
norm: marking services
Industry: Professional Servicesllm

Discovered: Jun 26, 2021
Breach occurred: Jun 11, 2021 – Jun 26, 2021
Undetected for: 15 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 2state-resident count only
Data types: PIIIdentity (basic)
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1078 Valid AccountsT1195 Supply Chain Compromise
Threat actor: External
Initial access: supply_chain

During the incident: Launched an investigation in consultation with outside cybersecurity professionals
Reset all administrator passwords
Implemented multifactor authentication
Deployed a new endpoint monitoring solution
Changes made: Implemented multifactor authentication
Deployed a new endpoint monitoring solution
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 37 weeks(259 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Indiana State AGMar 11 · first

Maine State AG+1d

Montana State AG+1d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-Notification-Letter-265.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 12, 2022
Raw hash: ec37438ad35a9f6aca8da7fad2a62b1a629b3f239cf4a7d76706a2a942bc1e59

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityMarking Services, Inc.

Victim entityMarking Services, Inc.

Incidentdiscovered Jun 26, 2021

Stated responseLaunched an investigation in consultation with outside cybersecurity professionals

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov