GFL Environmental Inc.
ent_0721862a294741414a09538b
Disclosures
5
State AG · 5 jurisdictions
Multi-filing incidents
1
incidents joining 2+ filings here
Max affected reported
26,571
nationwide · State AG IN
Leak-site claims
0
none in sample
Identity resolution
- Canonical name
- GFL Environmental Inc.
- Normalized
- gfl environmental— dedupe via name-norm; Microsoft / MSFT collapse to one row
- GLEIF LEI
- 894500E7NLBY9VZRT696
- SEC EDGAR CIK
- 0001780232
- Domain
- gflenv.com
Disclosure history (5)newest first
- Indiana State AGas victim2021-12-22
GFL Environmental reported a data breach to the Indiana Attorney General. The breach occurred on 2021-10-07 and was reported on 2021-12-22. 233 Indiana residents were affected. 26,571 individuals affected in total.
- Montana State AGas victim2021-12-22
GFL Environmental Inc. notified Montana residents of a ransomware attack discovered on October 8, 2021. The threat actor accessed systems between Oct 7-8, 2021, copying limited personal information (names) before deploying ransomware. GFL engaged cybersecurity firms and law enforcement, enhanced security measures, and offered 12 months of Equifax credit monitoring.
- Massachusetts State AGas victim2021-12-21
GFL Environmental Inc. reported a data breach to the Massachusetts Office of Consumer Affairs and Business Regulation. The breach was reported on 2021-12-21. 7 Massachusetts residents were affected. The report records the breach type as electronic.
- Maine State AGas victim2021-12-21
On October 7, 2021, GFL Environmental Inc. experienced an external system breach (hacking) that was discovered the next day. The breach affected 26,571 individuals, including one Maine resident, and compromised names along with driver's license or non-driver identification card numbers. The company began notifying affected individuals on December 22, 2021, and offered 12 months of complimentary credit monitoring and fraud protection services.
- Illinois State AGas victim2021-01-01
GFL ENVIRONMENTAL filed a data-breach notice with the Illinois Attorney General during 2021 (case 21-520). The register records the breach as discovered on October 8, 2021. Illinois does not publish the number of people affected — 815 ILCS 530/10 permits the Attorney General to publish only the entity name, the types of personal information and the date range.