Jacuzzi

On December 15, 2020, Jacuzzi fell victim to a ransomware attack that compromised the personal information of its current and former employees, as well as their beneficiaries. The breach involved unauthorized access to the company’s systems, where attackers encrypted sensitive data and prepared files for exfiltration. The exposed information may have included highly confidential details such as names, Social Security numbers, bank account information, dates of birth, and potentially health records. The incident was severe enough to warrant a formal notification, which was issued to affected individuals on February 23, 2021. The attack not only disrupted internal operations but also posed significant risks of identity theft, financial fraud, and reputational damage due to the sensitive nature of the leaked data. The involvement of ransomware further escalated the threat, as it indicated a deliberate and sophisticated effort to extort the company while exploiting vulnerable employee data.

Source: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/8fb48dc4-b174-4d80-bace-88d403e1a1bc.shtml

TPRM report: https://www.rankiteo.com/company/jacuzzi-group

"id": "jac007091825",
"linkid": "jacuzzi-group",
"type": "Ransomware",
"date": "12/2020",
"severity": "85",
"impact": "3",
"explanation": "Attack with significant impact with internal employee data leaks"

{'affected_entities': [{'customers_affected': 'current and former employees '
                                              'and their beneficiaries',
                        'industry': 'manufacturing (hot tubs, bath products)',
                        'name': 'Jacuzzi',
                        'type': 'company'}],
 'data_breach': {'data_encryption': 'yes (files encrypted)',
                 'data_exfiltration': 'prepared for removal (potential '
                                      'exfiltration)',
                 'personally_identifiable_information': 'yes',
                 'sensitivity_of_data': 'high',
                 'type_of_data_compromised': ['personally identifiable '
                                              'information (PII)',
                                              'financial data',
                                              'health data (potentially)']},
 'date_detected': '2020-12-15',
 'date_publicly_disclosed': '2021-02-23',
 'description': "The Maryland Attorney General's Office reported that Jacuzzi "
                'experienced a ransomware attack on December 15, 2020, '
                'potentially affecting personal information of current and '
                'former employees and their beneficiaries. The breach involved '
                'unauthorized access that encrypted data and prepared files '
                'for removal, which may have included names, Social Security '
                'numbers, bank account information, dates of birth, and '
                'potentially health information.',
 'impact': {'data_compromised': ['names',
                                 'Social Security numbers',
                                 'bank account information',
                                 'dates of birth',
                                 'health information (potentially)'],
            'identity_theft_risk': 'high',
            'payment_information_risk': 'high'},
 'ransomware': {'data_encryption': 'yes',
                'data_exfiltration': 'prepared for removal (potential)'},
 'references': [{'source': "Maryland Attorney General's Office"}],
 'regulatory_compliance': {'regulatory_notifications': 'Maryland Attorney '
                                                       "General's Office"},
 'response': {'communication_strategy': 'notification sent to affected '
                                        'individuals (2021-02-23)'},
 'title': 'Jacuzzi Ransomware Attack (2020)',
 'type': 'ransomware'}