Breach taxonomy
Summary
Crimson Wine Group detected a ransomware attack on June 30, 2024, that encrypted portions of its IT systems and involved the exfiltration of data. The attack disrupted operations across multiple business functions. The company engaged cybersecurity specialists and law enforcement; systems were substantially restored by the filing date. The incident was determined to be material.
Tagging rationale
ThreatUnknown
Filing does not attribute the incident to a specific actor → UNKNOWN.
MethodsRansomwareData Exfil
Filing confirms ransomware encryption of systems and exfiltration of data prior to or during the attack → RANSOMWARE + DATA-EXFIL.
AssetsConfidential BizRevenue Process
Ransomware encrypted business IT systems disrupting operations (REVENUE-PROCESS) and data was exfiltrated suggesting confidential business information was compromised (CONFIDENTIAL-BIZ).
EffectsCyber ExtortionBiz InterruptionInfo Privacy Loss
Ransomware attack involved extortion demand (CYBER-EXTORTION), caused operational disruption (BIZ-INTERRUPTION), and involved exfiltration of company data (INFO-PRIVACY-LOSS).
Business continuityEffective
Filing states systems were substantially restored by the filing date, indicating the incident response and recovery were effective.
Impact
Ransomware with data exfiltration at a mid-size wine company; operations disrupted but substantially restored within weeks; no confirmed ransom payment amount → score 3.
InsuranceNot disclosed
Filing makes no mention of insurance → null.
Read the original SEC filing excerpt
Item 1.05 Material Cybersecurity Incidents. On June 30, 2024, Crimson Wine Group, Ltd. (the Company) became aware of a ransomware attack that encrypted portions of the Company's information technology systems. The Company determined this incident to be material. The Company promptly took steps to contain and investigate the incident, engaged leading cybersecurity specialists and notified law enforcement. The investigation determined that data was also exfiltrated during the attack. The Company's systems have been substantially restored and normal business operations are resuming as of the date of this filing.