HackingProfessional ServicesProfessional ServicesCustomer Data InvolvedIdentity (basic)Government IDCriticalContained

SET FORTH, LLC

bd_053b1cfa2730f6dc · schema v1 · pii pii-v1

Severity

Critical

Discovered

May 21, 2024

Filed

Nov 8, 2024

To disclose

24 weeks

Affected · nationwide

1,500,0003,285 in this filing

Linked

9 filings

Confidence

65%

Full breach record for SET FORTH, LLC →2 incidents on file

Set Forth, Inc. experienced an external system breach on May 21, 2024, affecting up to 1.5 million individuals, including 3,285 Maine residents. The incident involved unauthorized access to personal information including names, addresses, dates of birth, and Social Security numbers. The company engaged forensic specialists, reset passwords, and offered 12 months of identity protection services.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered May 21, 2024 → Filed with AG Nov 8, 2024171d ✗ ME AG >90d24 weeks discovery → filing

⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Incident timeline

discovery → filing · 24 weeks / 171 days

May 21, 2024

Begins

May 21, 2024

Discovered

Nov 8, 2024

Filed

vs. sector median

+7 wks slower

This filing is one of 9 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (8) · sorted by filing gap

Indiana State AGbd_19bd4a8cd27b51a72024-11-08Verified
Vermont State AGbd_86c3ebcdc62180e52024-11-08Verified
Washington State AGbd_8d314c7b9b94e31e2024-11-08Verified
Montana State AGbd_a04866eaf2ae89642024-11-08Verified

Show 4 more filings ↓up to 7d gap

California State AGbd_add6e355c7826d482024-11-08Verified
South Carolina State AGbd_dac80c060386e2cd2024-11-08Verified
Delaware State AGbd_e05ab144b791977d2024-11-08Verified
Illinois State AGbd_f7422bf0dad1b5362024-11-01 · +7dVerified

Name: SET FORTH, LLC
norm: set forth

Name: SET FORTH, LLC
norm: set forth
Industry: Professional Servicesllm

Discovered: May 21, 2024
Breach occurred: May 21, 2024
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Nov 8, 2024
Affected individuals: 1,500,000state + nationwide
Data types: Identity (basic)Government ID
Data elements: Social Security numberDate of birth
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: External
Initial access: exploit_public_facing

During the incident: Implemented incident response protocols
Engaged independent computer forensic specialists to investigate the activity
Deployed enhanced endpoint monitoring software
Performed a global password reset
Implemented additional security controls
Offering identity theft protection services through Cyberscout for 12 months
Changes made: Deployed enhanced endpoint monitoring software
Performed a global password reset
Implemented additional security controls
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 24 weeks(171 days from discovery to filing)
Compliance flags: ME AG >90d · 171dME resident >60d · 171dME CRA notice due
Discovery-date grounding: occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: May 21, 2024
→ Filed with AG: Nov 8, 2024
171d 90 days ME AG >90d
Maine
Discovered: May 21, 2024
→ Notified: Nov 8, 2024
171d 60 days (analyst band; statutory cap is 30 days) ME resident >60d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: May 21, 2024 → Filed with AG: Nov 8, 2024	171d	90 days	ME AG >90d
Maine	Discovered: May 21, 2024 → Notified: Nov 8, 2024	171d	60 days (analyst band; statutory cap is 30 days)	ME resident >60d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 9 filings · 9 states

View merged incident ↗

Illinois State AGNov 1 · first

Indiana State AG+7d

Vermont State AG+7d

Washington State AG+7d

Montana State AG+7d

California State AG+7d

South Carolina State AG+7d

Delaware State AG+7d

Maine State AG+7d · this page

Pattern: first filing Nov 1 (IL), last Nov 8 (ME) — a 7-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/5c00fedb-134a-4436-b778-5df30b84cdab.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 8, 2024
Raw hash: 9665f11908f07c1b37349dff20d91b491f5a2c9f3c3d2f5ff9cea6119b63ec27

Linked disclosures

Regulatory filings (8) · sorted by filing gap

Reporting entitySET FORTH, LLC

Victim entitySET FORTH, LLC

Incidentdiscovered May 21, 2024

Stated responseImplemented incident response protocols

ComplianceME AG >90d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov