Incident Types: The types of cybersecurity incidents that have occurred include Ransomware, Breach and Cyber Attack.

Detection and Response: The company detects and responds to cybersecurity incidents through an third party assistance with worked with third-party cybersecurity specialists, and containment measures with secured its servers upon discovery, and communication strategy with sent out breach notice to impacted individuals, and and containment measures with incident contained early (details unspecified), and remediation measures with comprehensive forensic analysis launched, and communication strategy with public disclosure via local news (wrdw/wagt); internal communication to employees, and incident response plan activated with yes, and containment measures with isolation of affected vlans to prevent lateral movement, containment measures with activation of 24/7 cybersecurity operations center (csoc) team, containment measures with verification of offline backup integrity (unencrypted), containment measures with deployment of updated endpoint detection and response (edr) agents with new indicators of compromise (iocs), and recovery measures with resumption of production lines, recovery measures with option for employees to perform preventive maintenance with full pay or depart without compensation, recovery measures with leveraging disaster recovery (dr) and business continuity (bcp) redundancies, and communication strategy with public statement emphasizing swift containment and no data compromise, communication strategy with reassurance to stakeholders about operational resilience, communication strategy with commitment to a comprehensive post-incident report, and network segmentation with pre-existing (part of cybersecurity framework), and enhanced monitoring with pre-existing (continuous security monitoring), and incident response plan activated with yes, and containment measures with isolation of affected vlans to prevent lateral movement, containment measures with activation of cybersecurity operations center (csoc) for 24/7 monitoring, containment measures with verification of offline backup integrity, and remediation measures with deployment of updated endpoint detection and response (edr) agents with new iocs, and recovery measures with resumed production operations, recovery measures with disaster recovery (dr) and business continuity (bcp) redundancies leveraged, and communication strategy with public statement emphasizing containment and no data compromise, communication strategy with reassurance to stakeholders and employees, communication strategy with commitment to publish a post-incident report, and network segmentation with existing framework (enhanced during response), and enhanced monitoring with continuous security monitoring (part of existing framework)..

Common Attack Types: The most common types of attacks the company has faced is Cyber Attack.

Identification of Attack Vectors: The company identifies the attack vectors used in incidents through SCADA network segmentUnauthorized access attempts via unusual network traffic and SCADA network segmentUnauthorized access via unusual network traffic.

Commonly Compromised Data Types: The types of data most commonly compromised in incidents are Names, Social Security Numbers, Bank Account Information, , Names, Full Dates Of Birth, , None and None.

Incident Response Plan: The company's incident response plan is described as Yes, Yes.

Third-Party Assistance: The company involves third-party assistance in incident response through Worked with third-party cybersecurity specialists.

Prevention of Data Exfiltration: The company takes the following measures to prevent data exfiltration: Comprehensive forensic analysis launched, Deployment of updated Endpoint Detection and Response (EDR) agents with new IoCs, .

Handling of PII Incidents: The company handles incidents involving personally identifiable information (PII) through by secured its servers upon discovery, incident contained early (details unspecified), isolation of affected vlans to prevent lateral movement, activation of 24/7 cybersecurity operations center (csoc) team, verification of offline backup integrity (unencrypted), deployment of updated endpoint detection and response (edr) agents with new indicators of compromise (iocs), , isolation of affected vlans to prevent lateral movement, activation of cybersecurity operations center (csoc) for 24/7 monitoring, verification of offline backup integrity and .

Data Recovery from Ransomware: The company recovers data encrypted by ransomware through Resumption of production lines, Option for employees to perform preventive maintenance with full pay or depart without compensation, Leveraging Disaster Recovery (DR) and Business Continuity (BCP) redundancies, , Resumed production operations, Disaster Recovery (DR) and Business Continuity (BCP) redundancies leveraged, .

Implemented Recommendations: The company has implemented the following recommendations to improve cybersecurity: Review potential zero-day exploits, Focus on patch management gaps during forensic investigation, Reinforce cybersecurity resilience in global manufacturing network and Implement configuration hardening measures.

Additional Resources: Stakeholders can find additional resources on cybersecurity best practices at and Source: Washington State Office of the Attorney GeneralDate Accessed: 2022-08-29, and Source: WRDW/WAGT NewsDate Accessed: 2025-09-02, and Source: Bridgestone Americas Public Statement, and Source: Local Official Reports (Joliette Mayor Pierre-Luc Bellerose), and Source: Bridgestone Americas Public Statement, and Source: Local Official Reports (e.g., Joliette Mayor Pierre-Luc Bellerose).

Communication of Investigation Status: The company communicates the status of incident investigations to stakeholders through Sent out breach notice to impacted individuals, Public disclosure via local news (WRDW/WAGT); internal communication to employees, Public Statement Emphasizing Swift Containment And No Data Compromise, Reassurance To Stakeholders About Operational Resilience, Commitment To A Comprehensive Post-Incident Report, Public Statement Emphasizing Containment And No Data Compromise, Reassurance To Stakeholders And Employees and Commitment To Publish A Post-Incident Report.

Advisories Provided: The company provides the following advisories to stakeholders and customers following an incident: were Public statement confirming no customer data was affected, Reassurance About Minimal Downtime And Data Integrity, Commitment To Transparency Via Post-Incident Report, No customer data compromised; operations fully resumed, Reassurance Of Minimal Downtime And Data Integrity, Commitment To Transparency Via Post-Incident Report, No Customer Data Compromised; Operations Resumed and .

Post-Incident Analysis Process: The company's process for conducting post-incident analysis is described as Worked with third-party cybersecurity specialists, Pre-existing (continuous security monitoring), Continuous Security Monitoring (Part Of Existing Framework), .

Corrective Actions Taken: The company has taken the following corrective actions based on post-incident analysis: Patch Management Review, Zero-Day Exploit Assessment, Configuration Hardening, Enhanced Cybersecurity Resilience Measures, , Patch Management Review, Zero-Day Exploit Investigation, Configuration Hardening, .

Last Attacking Group: The attacking group in the last incident was an Unattributed (similarities to LockBit group tactics).

Most Recent Incident Detected: The most recent incident detected was on 2022-02-09.

Most Recent Incident Publicly Disclosed: The most recent incident publicly disclosed was on 2025-09-02.

Most Significant Data Compromised: The most significant data compromised in an incident were names, Social Security numbers, bank account information, , Names, Full Dates of Birth, , None (customer data reportedly unaffected), None (no customer or employee data compromised) and None (no customer or employee data compromised).

Most Significant System Affected: The most significant system affected in an incident was Manufacturing facilities and SCADA (Supervisory Control and Data Acquisition) network segmentProduction control systemsVLANs (Virtual Local Area Networks) and SCADA (Supervisory Control and Data Acquisition) networksProduction control systemsVLANs (isolated).

Third-Party Assistance in Most Recent Incident: The third-party assistance involved in the most recent incident was Worked with third-party cybersecurity specialists.

Containment Measures in Most Recent Incident: The containment measures taken in the most recent incident were Secured its servers upon discovery, Incident contained early (details unspecified), Isolation of affected VLANs to prevent lateral movementActivation of 24/7 Cybersecurity Operations Center (CSOC) teamVerification of offline backup integrity (unencrypted)Deployment of updated Endpoint Detection and Response (EDR) agents with new Indicators of Compromise (IoCs) and Isolation of affected VLANs to prevent lateral movementActivation of Cybersecurity Operations Center (CSOC) for 24/7 monitoringVerification of offline backup integrity.

Most Sensitive Data Compromised: The most sensitive data compromised in a breach were Names, None (customer data reportedly unaffected), None (no customer or employee data compromised), names, Full Dates of Birth, Social Security numbers and bank account information.

Number of Records Exposed in Most Significant Breach: The number of records exposed in the most significant breach was 112.0.

Most Significant Recommendation Implemented: The most significant recommendation implemented to improve cybersecurity was Review potential zero-day exploits, Focus on patch management gaps during forensic investigation, Investigate potential zero-day exploits, Reinforce cybersecurity resilience in global manufacturing network, Implement configuration hardening measures and Focus on patch management gaps.

Most Recent Source: The most recent source of information about an incident are Local Official Reports (e.g., Joliette Mayor Pierre-Luc Bellerose), Bridgestone Americas Public Statement, Washington State Office of the Attorney General, Local Official Reports (Joliette Mayor Pierre-Luc Bellerose) and WRDW/WAGT News.

Current Status of Most Recent Investigation: The current status of the most recent investigation is Ongoing (forensic analysis in progress).

Most Recent Stakeholder Advisory: The most recent stakeholder advisory issued was Reassurance about minimal downtime and data integrity, Commitment to transparency via post-incident report, Reassurance of minimal downtime and data integrity, Commitment to transparency via post-incident report, .

Most Recent Customer Advisory: The most recent customer advisory issued were an Public statement confirming no customer data was affected, No customer data compromised; operations fully resumed and No customer data compromised; operations resumed.

Most Significant Corrective Action: The most significant corrective action taken based on post-incident analysis was Patch management reviewZero-day exploit assessmentConfiguration hardeningEnhanced cybersecurity resilience measures, Patch management reviewZero-day exploit investigationConfiguration hardening.