HackingManufacturingManufacturingVulnerability ExploitData ExfiltratedCustomer Data InvolvedGovernment IDIdentity (basic)Financial accountMediumContained

Apache Mills, Inc. (apachemills.com)

bd_fc3ce5e206ea3c46 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Aug 17, 2024

Filed

Mar 3, 2025

To disclose

28 weeks

Affected

1state residents only

Linked

2 filings

Confidence

66%

Full breach record for Apache Mills, Inc. (apachemills.com) →

Apache Mills Inc. notified the Maryland Attorney General of a cybersecurity incident occurring between August 13 and 17, 2024. An unauthorized actor accessed systems containing names, Social Security numbers, and health insurance information. One Maryland resident was affected. Apache Mills engaged law enforcement and third-party specialists, secured its network, and offered 12 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Maryland clock✗ MD AG >90d28 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 4 days

discovery → filing · 28 weeks / 198 days

Aug 13, 2024

Begins

Aug 17, 2024

Discovered

Mar 3, 2025

Filed

vs. sector median

+18 wks slower

This filing is one of 2 about the same incident.View merged incident

A leak claim by fog about this victim predates this filing by 130 days.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Sitefogbd_88335360b6fa6e182024-10-24 · +130dCandidate

Name: Apache Mills, Inc. (apachemills.com)
norm: apache mills inc apachemillscom
Domain: apachemills.com

Name: Apache Mills, Inc. (apachemills.com)
norm: apache mills inc apachemillscom
Domain: apachemills.com
Industry: Manufacturingllm

Discovered: Aug 17, 2024
Breach occurred: Aug 13, 2024 – Aug 17, 2024
Undetected for: 4 daysoccurrence → discovery
Materiality determined: —
Notification sent: Mar 3, 2025
Affected individuals: 1state-resident count only
Data types: Government IDIdentity (basic)Financial account
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: External
Initial access: exploit_public_facing

During the incident: Contacted law enforcement
Engaging third-party specialists to assist with determining the nature and scope of the event
Secured its network environment
Undertook a thorough investigation
Began providing notice to the potentially impacted individuals on March 03, 2025 via U.S. mail
Changes made: Implemented additional technical safeguards to further enhance the security of information in its possession and to prevent similar events from happening in the future
Offering the potentially impacted individuals 12 months of complimentary credit monitoring and identity protection services
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 28 weeks(198 days from discovery to filing)
Compliance flags: MD AG >90dLeak >90d
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.maryland.gov/resources-info/SBN%20Documents/2025/ITU-376495.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 3, 2025
Raw hash: eb7648f4640520ea9b34766f883d97067182f122ac7c47c9976db85e0d9ca109

Linked disclosures

Ransomware claims (1)

Reporting entityApache Mills, Inc. (apachemills.com)

Victim entityApache Mills, Inc. (apachemills.com)

Incidentdiscovered Aug 17, 2024

Stated responseContacted law enforcement

ComplianceMD AG >90d

Extraction provenanceno artifact recorded

Source provenanceoag.maryland.gov