Incident Types: The types of cybersecurity incidents that have occurred include Ransomware and Breach.

Total Financial Loss: The total financial loss from these incidents is estimated to be $0.

Detection and Response: The company detects and responds to cybersecurity incidents through an third party assistance with cisco talos (research/analysis), and remediation measures with log clearing, remediation measures with binary deletion, remediation measures with evidence elimination (by attackers), remediation measures with ransom note deployment..

Common Attack Types: The most common types of attacks the company has faced is Breach.

Identification of Attack Vectors: The company identifies the attack vectors used in incidents through Compromised Company ServersInsider Access (Employees)Phishing/Malware (Consumer Devices)Stolen Personal Devices and vulnerable SMB servicesstolen administrator credentials.

Average Financial Loss: The average financial loss per incident is $0.00.

Commonly Compromised Data Types: The types of data most commonly compromised in incidents are Pii (E.G., Names, Ssns, Birth Certificates), Financial Data (E.G., Banking Credentials), Credit Information, Child Identity Data, , Enterprise Data, Sql Databases, Virtual Machine Disks, Network Shares, Local Files and .

Third-Party Assistance: The company involves third-party assistance in incident response through Cisco Talos (research/analysis), .

Prevention of Data Exfiltration: The company takes the following measures to prevent data exfiltration: log clearing, binary deletion, evidence elimination (by attackers), ransom note deployment, .

Ensuring Regulatory Compliance: The company ensures compliance with regulatory requirements through Potential (consumer benefits like credit monitoring may be mandated).

Key Lessons Learned: The key lessons learned from past incidents are Consumers must proactively monitor credit and financial accounts post-breach.,Credit freezes and fraud alerts are critical tools to mitigate identity theft risks.,Password hygiene (e.g., frequent changes, 2FA) reduces exposure from credential theft.,Biometric authentication alone is insufficient due to AI-driven spoofing risks.,State laws provide some recourse, but individual vigilance remains essential.Limit exposure of internet-facing services (e.g., SMB).,Enforce strong authentication and access controls.,Maintain updated backups and test restoration processes.,Monitor for unusual activity (e.g., benchmarking tests, credential harvesting).,Segment networks to limit lateral movement.,Patch vulnerabilities promptly to prevent exploitation.

Additional Resources: Stakeholders can find additional resources on cybersecurity best practices at and Source: Federal Trade Commission (FTC)Url: https://www.consumer.ftc.gov/, and Source: NerdWallet - Credit Freeze GuideUrl: https://www.nerdwallet.com/article/finance/credit-freeze, and Source: AnnualCreditReport.comUrl: https://www.annualcreditreport.com/, and Source: Cisco Talos Research, and Source: TechRadar ProUrl: https://www.techradar.com.

Advisories Provided: The company provides the following advisories to stakeholders and customers following an incident: were Freeze Credit Immediately To Prevent New Account Fraud., Use Fraud Alerts As A Temporary Alternative If Credit Access Is Needed., Enable 2Fa And Update Passwords For All Critical Accounts., Monitor Credit Reports And Card Statements For Signs Of Fraud., Leverage State-Mandated Benefits (E.G., Credit Monitoring) If Offered Post-Breach. and .

Post-Incident Analysis Process: The company's process for conducting post-incident analysis is described as Cisco Talos (Research/Analysis), .

Corrective Actions Taken: The company has taken the following corrective actions based on post-incident analysis: Isolate And Patch Exposed Services., Implement Credential Hygiene And Mfa., Deploy Behavioral-Based Detection For Ransomware Activities., Enhance Logging And Monitoring For Unusual Processes (E.G., Test File Encryption)., Secure Backups With Immutability And Air-Gapping., .

Last Ransom Demanded: The amount of the last ransom demanded was $1 million (in Bitcoin).

Last Attacking Group: The attacking group in the last incident were an Hackers (External)Malicious Insiders (Employees)Opportunistic Criminals (via Phishing/Malware) and Kraken ransomware group (linked to former HelloKitty group).

Highest Financial Loss: The highest financial loss from an incident was Potential (varies per individual; includes unauthorized transactions, identity theft, and credit damage).

Most Significant Data Compromised: The most significant data compromised in an incident were Personally Identifiable Information (PII), Financial Data (e.g., banking passwords), Credit History, Child Identity Data (if applicable), and .

Most Significant System Affected: The most significant system affected in an incident was Windows systemsLinux systemsESXi systemsSQL databasesnetwork shareslocal drivesHyper-V virtual machines.

Third-Party Assistance in Most Recent Incident: The third-party assistance involved in the most recent incident was cisco talos (research/analysis), .

Most Sensitive Data Compromised: The most sensitive data compromised in a breach were Financial Data (e.g., banking passwords), Child Identity Data (if applicable), Personally Identifiable Information (PII) and Credit History.

Highest Ransom Demanded: The highest ransom demanded in a ransomware incident was $1 million (in Bitcoin).

Most Significant Legal Action: The most significant legal action taken for a regulatory violation was Potential (consumer benefits like credit monitoring may be mandated).

Most Significant Lesson Learned: The most significant lesson learned from past incidents was Patch vulnerabilities promptly to prevent exploitation.

Most Significant Recommendation Implemented: The most significant recommendation implemented to improve cybersecurity was Deploy strong ransomware protection (e.g., behavioral detection, endpoint security)., Restrict internet-facing services like RDP and SMB., Implement network segmentation to isolate critical systems., Regularly audit and rotate credentials., Ensure backups are immutable and offline., Use multi-factor authentication (MFA) for remote access., Update antivirus/anti-malware solutions and conduct regular scans. and Monitor for indicators of compromise (IoCs) associated with Kraken..

Most Recent Source: The most recent source of information about an incident are Federal Trade Commission (FTC), NerdWallet - Credit Freeze Guide, TechRadar Pro, AnnualCreditReport.com and Cisco Talos Research.

Most Recent URL for Additional Resources: The most recent URL for additional resources on cybersecurity best practices is https://www.consumer.ftc.gov/, https://www.nerdwallet.com/article/finance/credit-freeze, https://www.annualcreditreport.com/, https://www.techradar.com .

Current Status of Most Recent Investigation: The current status of the most recent investigation is Ongoing (public IoCs documented by Cisco Talos).

Most Recent Customer Advisory: The most recent customer advisory issued were an Freeze credit immediately to prevent new account fraud.Use fraud alerts as a temporary alternative if credit access is needed.Enable 2FA and update passwords for all critical accounts.Monitor credit reports and card statements for signs of fraud.Leverage state-mandated benefits (e.g. and credit monitoring) if offered post-breach.

Most Significant Root Cause: The most significant root cause identified in post-incident analysis was Inadequate server security (for hacking cases)Lack of insider threat monitoringHuman error (accidental exposure)Poor consumer password hygieneSusceptibility to phishing/malware, Exposed SMB services with weak credentials.Lack of network segmentation allowing lateral movement.Insufficient monitoring for benchmarking or pre-encryption activities.Inadequate backup protection (shadow copies/Recycle Bin deleted)..

Most Significant Corrective Action: The most significant corrective action taken based on post-incident analysis was Isolate and patch exposed services.Implement credential hygiene and MFA.Deploy behavioral-based detection for ransomware activities.Enhance logging and monitoring for unusual processes (e.g., test file encryption).Secure backups with immutability and air-gapping..