MalwareManufacturingManufacturingRansomwareData ExfiltratedData EncryptedPIIIdentity (basic)MediumContained

Plug Power Inc.

bd_fdd829aeab061acf · schema v1 · pii pii-v1

Severity

Medium

Discovered

Mar 22, 2023

Filed

Dec 15, 2023

To disclose

38 weeks

Affected

8,323scope not determined

Linked

4 filings

Confidence

67%

Full breach record for Plug Power Inc. →3 incidents on file

Plug Power Inc. disclosed a ransomware incident occurring March 13-23, 2023, discovered March 22, 2023. Unauthorized access may have exposed personal information of 8,323 individuals. The company engaged forensic experts, notified law enforcement, and offered credit monitoring.

J jump to incidentP pin to compareR raw source

Vermont clock✗ VT AG >45 bday38 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 9 days

discovery → filing · 38 weeks / 268 days

Mar 13, 2023

Begins

Mar 22, 2023

Discovered

Dec 15, 2023

Filed

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Montana State AGbd_a7a20cf50beef4f52023-12-15Candidate
New Hampshire State AGbd_b0cc7596c5b908982023-12-15Verified
Maine State AGbd_cea3305b3d38602b2023-12-15Verified by operator

Name: Plug Power Inc.
norm: plug power
Domain: plugpower.com

Name: Plug Power Inc.
norm: plug power
Domain: plugpower.com
Industry: Manufacturingllm

Discovered: Mar 22, 2023
Breach occurred: Mar 13, 2023 – Mar 23, 2023
Undetected for: 9 daysoccurrence → discovery
Materiality determined: Dec 15, 2023
Notification sent: Dec 15, 2023
Affected individuals: 8,323scope not determined
Data types: PIIIdentity (basic)
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial

During the incident: Engaged third-party cyber experts to determine the nature and scope of the incident
Notified law enforcement
Offering complimentary credit monitoring services through IDX, A ZeroFox Company
Changes made: Recover and restore impacted systems
Make additional improvements that strengthen our cybersecurity protections
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 38 weeks(268 days from discovery to filing)
Compliance flags: VT AG >45 bday
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Montana State AGDec 15 · first

New Hampshire State AGDec 15 · first

Maine State AGDec 15 · first

Vermont State AGDec 15 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ago.vermont.gov/document/2023-12-15-plug-power-data-breach-notice-consumers
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 15, 2023
Raw hash: fa711b47d424cc4cb0bdd38ff83066b4fbeca43523ba4386693f6a63c0b2942f

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityPlug Power Inc.

Victim entityPlug Power Inc.

Incidentdiscovered Mar 22, 2023

Stated responseEngaged third-party cyber experts to determine the nature and scope of the incident

ComplianceVT AG >45 bday

Extraction provenanceno artifact recorded

Source provenanceago.vermont.gov