{ "id": "61d7e569-cbe4-40d8-bd6b-8e614037a7d2", "created_at": "2026-04-06T00:08:37.330768Z", "updated_at": "2026-04-10T03:20:37.278638Z", "deleted_at": null, "sha1_hash": "823ac72c673c8550cba98c722a7ae38e33fabd0d", "title": "Snap-on discloses data breach claimed by Conti ransomware gang", "llm_title": "", "authors": "", "file_creation_date": "0001-01-01T00:00:00Z", "file_modification_date": "0001-01-01T00:00:00Z", "file_size": 3002222, "plain_text": "Snap-on discloses data breach claimed by Conti ransomware gang\r\nBy Lawrence Abrams\r\nPublished: 2022-04-08 ยท Archived: 2026-04-05 17:49:18 UTC\r\nSource: snapon.com\r\nAmerican automotive tools manufacturer Snap-on announced a data breach exposing associate and franchisee data after the\r\nConti ransomware gang began leaking the company's data in March.\r\nSnap-on is a leading manufacturer and designer of tools, software, and diagnostic services used by the transportation\r\nindustry through various brands, including Mitchell1, Norbar, Blue-Point, Blackhawk, and Williams.\r\nYesterday, Snap-on disclosed a data breach after they detected suspicious activity in their network, which led to them\r\nshutting down all of their systems.\r\n\"In early March, Snap-on detected unusual activity in some areas of its information technology environment. We quickly\r\ntook down our network connections as part of our defense protocols, particularly appropriate given heightened warnings\r\nfrom various agencies,\" reads a notice on the Snap-on website.\r\nhttps://www.bleepingcomputer.com/news/security/snap-on-discloses-data-breach-claimed-by-conti-ransomware-gang/\r\nPage 1 of 6\n\n0:00\r\nhttps://www.bleepingcomputer.com/news/security/snap-on-discloses-data-breach-claimed-by-conti-ransomware-gang/\r\nPage 2 of 6\n\nVisit Advertiser websiteGO TO PAGE\r\n\"We launched a comprehensive analysis assisted by a leading external forensics firm, identified the event as a security\r\nincident, and notified law enforcement of the incursion.\"\r\nAfter conducting an investigation, Snap-on discovered that threat actors stole personal data belonging to employees between\r\nMarch 1st and March 3rd, 2022.\r\n\"We believe the incident involved associate and franchisee data including information such as: names, Social Security\r\nNumbers, dates of birth, and employee identification numbers,\" discloses a Snap-on data breach notification submitted to the\r\nCalifornia Attorney General's office.\r\nSnap-on is offering a free one-year subscription to the IDX identity theft protection service for those affected.\r\nConti claimed an attack on Snap-on\r\nWhile Snap-on's data breach notification did not shed much light on its attack, BleepingComputer received an anonymous\r\ntip in early March stating that one of Snap-on's subsidiaries, Mitchell1, was suffering an outage caused by a ransomware\r\nattack.\r\nMitchell1 had initially tweeted about the outage but soon deleted the notices from Twitter and Facebook.\r\nDeleted Mitchell1 tweet about the outage\r\nSource: Archive.org\r\nhttps://www.bleepingcomputer.com/news/security/snap-on-discloses-data-breach-claimed-by-conti-ransomware-gang/\r\nPage 3 of 6\n\nHowever, another source told BleepingComputer that it was not Mitchel11 who had suffered an attack but their parent\r\ncompany Snap-on.\r\nSoon after, threat intelligence researcher Ido Cohen spotted that the Conti ransomware gang claimed to have attacked Snap-on and had begun to leak almost 1 GB of documents that were allegedly stolen during the attack.\r\nThe Conti gang quickly removed the data leak, and Snap-on has not reappeared on their data leak site, leading security\r\nresearchers to tell BleepingComputer that they believe Snap-on paid a ransom for the data not to be leaked.\r\nBleepingComputer has contacted Snap-on to confirm if the disclosed data breach is linked to the alleged Conti ransomware\r\nattack, and we will update this story if we hear back.\r\nhttps://www.bleepingcomputer.com/news/security/snap-on-discloses-data-breach-claimed-by-conti-ransomware-gang/\r\nPage 4 of 6\n\nWho is Conti Ransomware?\r\nConti is a ransomware operation operated by a Russian hacking group known for other malware infections, such as Ryuk,\r\nTrickBot, and BazarLoader.\r\nConti commonly breaches a network after corporate devices become infected with the BazarLoader or TrickBot malware\r\ninfections, which provide remote access to the hacking group.\r\nOnce they gain access to an internal system, they spread through the network, steal data, and deploy the ransomware.\r\nThe Conti gang recently suffered their own data breach after siding with Russia over the invasion of Ukraine, leading to a\r\nUkrainian researcher publishing almost 170,000 internal chat conversations between the Conti ransomware gang members\r\nand the Conti ransomware source code.\r\nConti siding with Russia on the invasion of Ukraine\r\nSource: BleepingComputer\r\nConti is known for past attacks on high-profile organizations, including Ireland's Health Service Executive (HSE) and\r\nDepartment of Health (DoH), the City of Tulsa, Broward County Public Schools, and Advantech.\r\nDue to the cybercrime gang's ongoing activity, the US government issued an advisory on Conti ransomware attacks.\r\nAutomated Pentesting Covers Only 1 of 6 Surfaces.\r\nhttps://www.bleepingcomputer.com/news/security/snap-on-discloses-data-breach-claimed-by-conti-ransomware-gang/\r\nPage 5 of 6\n\nAutomated pentesting proves the path exists. BAS proves whether your controls stop it. Most teams run one without the\r\nother.\r\nThis whitepaper maps six validation surfaces, shows where coverage ends, and provides practitioners with three diagnostic\r\nquestions for any tool evaluation.\r\nSource: https://www.bleepingcomputer.com/news/security/snap-on-discloses-data-breach-claimed-by-conti-ransomware-gang/\r\nhttps://www.bleepingcomputer.com/news/security/snap-on-discloses-data-breach-claimed-by-conti-ransomware-gang/\r\nPage 6 of 6", "extraction_quality": 1, "language": "EN", "sources": [ "ETDA" ], "references": [ "https://www.bleepingcomputer.com/news/security/snap-on-discloses-data-breach-claimed-by-conti-ransomware-gang/" ], "report_names": [ "snap-on-discloses-data-breach-claimed-by-conti-ransomware-gang" ], "threat_actors": [], "ts_created_at": 1775434117, "ts_updated_at": 1775791237, "ts_creation_date": 0, "ts_modification_date": 0, "files": { "pdf": "https://archive.orkl.eu/823ac72c673c8550cba98c722a7ae38e33fabd0d.pdf", "text": "https://archive.orkl.eu/823ac72c673c8550cba98c722a7ae38e33fabd0d.txt", "img": "https://archive.orkl.eu/823ac72c673c8550cba98c722a7ae38e33fabd0d.jpg" } }