MalwareManufacturingManufacturingRansomwareCapture Stored DataData EncryptedData ExfiltratedIdentity (basic)Government IDFinancial accountHealth (basic)MediumResolved

Jacuzzi Inc.

bd_f72c1dedb87e6b5b · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jan 27, 2021

Filed

Feb 23, 2021

To disclose

27 days

Affected

3state residents only

Linked

5 filings

Confidence

66%

Full breach record for Jacuzzi Inc. →2 incidents on file

Jacuzzi Inc. disclosed a ransomware attack on its network. Unauthorized access occurred on December 15, 2021, resulting in data encryption and preparation of files for removal. The company determined on January 27, 2021, that files may have contained employee PII including SSNs, bank info, and health data. Notices were sent February 23, 2021. The incident is resolved; Kroll provided 2 years of identity monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline — partial

? — ?

Breach window unknown

Feb 23, 2021

Filed

—

Corroborated · see linked filings

Compliance clocks stay unassessable until a regulatory filing lands. Dashed segments fill in automatically when corroboration arrives.

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Massachusetts State AGbd_1380eb8e01b84dea2021-02-23Verified
Maine State AGbd_4fe807af058751a02021-02-23Candidate
New Hampshire State AGbd_9ff477834a8ed12a2021-02-23Verified
Indiana State AGbd_b94dbfe76e79ea082021-02-23Verified

Name: Jacuzzi Inc.
norm: jacuzzi

Name: Jacuzzi Inc.
norm: jacuzzi
Industry: Manufacturingllm

Discovered: Jan 27, 2021
Breach occurred: Dec 15, 2021
Materiality determined: —
Notification sent: Feb 23, 2021
Affected individuals: 3state-resident count only
Data types: Identity (basic)Government IDFinancial accountHealth (basic)
Data elements: Date of birth
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial

During the incident: Initiated an investigation
Engaged a third party cyber security firm to assist in determining the nature and scope of the attack
Provided information to law enforcement about the incident
Secured the services of Kroll to provide identity monitoring at no cost to you for two years
Changes made: Taken steps to mitigate any potential impact
Work with the third party cyber security firm to supplement and strengthen our existing security measures
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 27 days(27 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Massachusetts State AGFeb 23 · first

Maine State AGFeb 23 · first

New Hampshire State AGFeb 23 · first

Indiana State AGFeb 23 · first

Montana State AGFeb 23 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/uzziSamp-1.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 23, 2021
Raw hash: 89bf07103b4ed3c1f0606c3fc41e23ee386d5c68e2109a305f5e6e6c39b1e546

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityJacuzzi Inc.

Victim entityJacuzzi Inc.

Incidentdiscovered Jan 27, 2021

Stated responseInitiated an investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov