Sysco reported that a network intrusion began on 14 January 2023 and that the company became aware of it on 5 March. It disclosed the breach in a quarterly report filed with the Securities and Exchange Commission on 2 May 2023. An internal memo informing employees followed on 3 May.
Reported categories are customer and supplier data in the United States and Canada, and personal information of US employees including names, social security numbers and account numbers. The company reported the incident as affecting data relating to more than 126,000 individuals, and said customer service and business operations were not affected.
The Order Of Disclosure Says Who It Is For
A securities filing exists to inform investors of material risk. A breach notification exists to let an affected person act. Here the first preceded the second by a day.
The desk does not read that as concealment — a day is short, and the filing obligation has its own clock. It records the ordering because this corpus contains a great deal of evidence about which clock organisations actually run to. At 22-0617 an investigation concluded and notification followed a fortnight later; at 26-0721b it took 289 days. The obligation that is enforced is the one that gets met first.
Seven Weeks Undetected, Eight More To Disclosure
Intrusion on 14 January, awareness on 5 March, disclosure on 2 May. Roughly seven weeks inside before anyone knew, and roughly eight weeks after that before anyone outside was told.
The second interval is the one we have argued about at 23-0808b and 22-0120: investigation takes real time, and the affected person’s exposure runs throughout it. Social security numbers were reported among the categories, and those were as usable on 6 March as on 3 May.
Employees, Customers And Suppliers In One File
The reported categories span three populations with entirely different relationships to the company and no shared route to a remedy.
A supplier is a business, a customer is an account, an employee had no choice about handing over a social security number. We have recorded employee data as the least-considered casualty at 23-1219, 22-1111 and 23-0808, and files here the further problem that a single incident notification has to serve populations for whom the same disclosure means completely different things.
Compiled from the company’s SEC filing as reported, its internal communication as reported, and contemporaneous coverage, listed below. No actor is named and no entry route was published; neither is asserted. Class action filings are pleadings and no allegation from them is carried. Graded high on the timeline and the reported figure. Corrections: corrections@forensicpost.com.