HackingIdentity (basic)Government IDFinancial accountHealth (basic)MediumActive

Consumers Supply Distributing LLC

bd_f84a3b621fead88c · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jan 21, 2022

Filed

Feb 27, 2022

To disclose

5 weeks

Affected

1state residents only

Linked

4 filings

Confidence

64%

Full breach record for Consumers Supply Distributing LLC →

Consumers Supply Distributing, LLC notified employees of unauthorized network access occurring Jan 16-21, 2022. The actor removed files containing PII, SSNs, financial data, and health info. The company engaged forensic investigators, notified law enforcement, and offered Equifax credit monitoring. Investigation was ongoing at the time of notification.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 5 days

discovery → filing · 5 weeks / 37 days

Jan 16, 2022

Begins

Jan 21, 2022

Discovered

Feb 27, 2022

Filed

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Sitesuncryptbd_4be539f83693dc122022-02-05 · +22dVerified by operator

Regulatory filings (2) · sorted by filing gap

Indiana State AGbd_05fadee8bc6ae2272022-02-25 · +2dVerified by operator
Massachusetts State AGbd_06470fd60dac16042022-02-25 · +2dVerified by operator

Name: Consumers Supply Distributing LLC
norm: consumers supply distributing

Name: Consumers Supply Distributing LLC
norm: consumers supply distributing

Discovered: Jan 21, 2022
Breach occurred: Jan 16, 2022 – Jan 21, 2022
Undetected for: 5 daysoccurrence → discovery
Materiality determined: —
Notification sent: Feb 11, 2022
Affected individuals: 1state-resident count only
Data types: Identity (basic)Government IDFinancial accountHealth (basic)
Data elements: Social Security numberDate of birthMedical information
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: notifying regulatory authorities as required by law
Initial access: valid_credentials

During the incident: Took our systems offline
Began to investigate the incident
Working with third-party subject matter specialists to investigate
Launched an in-depth investigation with the assistance of third-party forensic investigators
Notified law enforcement
Notifying regulatory authorities
Notifying potentially affected individuals
Arranged to have Equifax provide credit monitoring services
Changes made: Reviewing our existing policies and procedures
Implementing additional safeguards to further secure the information in our systems
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 weeks(37 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Indiana State AGFeb 25 · first

Massachusetts State AGFeb 25 · first

Montana State AG+2d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-Notification-39.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 27, 2022
Raw hash: bdf422c33cb592589981c7449b779fc69cdd135397ffe4512db6ed1ed39c88eb

Linked disclosures

Ransomware claims (1)

Regulatory filings (2) · sorted by filing gap

Reporting entityConsumers Supply Distributing LLC

Victim entityConsumers Supply Distributing LLC

Incidentdiscovered Jan 21, 2022

Stated responseTook our systems offline

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov