Stanley Steemer breach exposed data on about 67,000 customers

Stanley Steemer International, the Dublin, Ohio carpet and upholstery cleaning company, filed a consumer breach notification with the Maine Attorney General's office in mid-November 2023. The company said it detected suspicious activity on March 6, 2023, and that its investigation traced the intruders' access back to February 10, meaning they had been inside the network for close to a month before discovery.

The exposed data was extensive. Stanley Steemer said attackers may have obtained customer names, Social Security numbers, driver's licence numbers and financial account information, including credit and debit card numbers together with security codes and PINs. The company did not disclose how the intruders first got in.

Victim counts differ between accounts. Cybersecurity Dive, citing the Maine filing, reported 66,978 people affected, 16 of them Maine residents. The Record put the figure at 67,921. Notices began going out on November 15, 2023, and the company completed the mailing on November 20 after searching its records for current addresses. Affected people were offered two years of complimentary credit monitoring.

Stanley Steemer notified federal authorities after the discovery, secured its systems and reviewed its internal cyber policies, completing that review by September 7, 2023. The Play ransomware group had claimed the company as a victim on March 17, saying it had taken accounting data, budgets, tax documents and passport images. Stanley Steemer did not confirm whether the incident involved ransomware.