HackingFinancial ServicesHealthcareFinanceData ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDFinancial accountHealth (basic)PHIHighContained

Sentinel Security Life Insurance Company and Atlantic Coast Life Insurance Company

bd_095dcadc4955e5ee · schema v1 · pii pii-v1

Severity

High

Discovered

Apr 15, 2025

Filed

Dec 30, 2025

To disclose

37 weeks

Affected · nationwide

57,25324 in this filing

Linked

6 filings

Confidence

65%

SSL and ACL (Sentinel Security Life Insurance Company and Atlantic Coast Life Insurance Company) disclosed an external system breach occurring between April 7 and April 15, 2025. The incident affected 57,253 individuals, including 24 Maine residents. Compromised data included names, SSNs, DOBs, financial account info, and health/insurance data. Notices were sent on December 30, 2025, offering 12 months of credit monitoring via IDX.

J jump to incidentP pin to compareR raw source

Maine clockScope identified Dec 17, 2025 → Filed with AG Dec 30, 202513d ✓ ME AG ≤30d37 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 8 days

discovery → filing · 37 weeks / 259 days

Apr 7, 2025

Begins

Apr 15, 2025

Discovered

Dec 30, 2025

Filed

vs. sector median

+29 wks slower

This filing is one of 6 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Indiana State AGbd_20b32120b817bae32025-12-30Verified
Massachusetts State AGbd_397ef66c5968b72e2025-12-30Verified
Oregon State AGbd_b7c80914ff178e862025-12-30Verified by operator
Texas State AGbd_421d9886a7a3e05a2026-01-05 · +6dVerified

Show 1 more filing ↓up to 29d gap

Illinois State AGbd_0e0cd0c9f475c5e52025-12-01 · +29dVerified

Name: SSL and ACL
norm: ssl and acl

Name: Sentinel Security Life Insurance Company and Atlantic Coast Life Insurance Company
norm: sentinel security life insurance company and atlantic coast life insurance company
Industry: Financial ServicesllmHealthcarellm

Discovered: Apr 15, 2025
Scope identified: Dec 17, 2025Maine’s notice clock starts here (10 M.R.S. §1348(1))The letter says: “On December 17, 2025, the Companies completed their review and determined that information related to you was included in the affected files.”
Breach occurred: Apr 7, 2025 – Apr 15, 2025
Undetected for: 8 daysoccurrence → discovery
Materiality determined: —
Notification sent: Dec 30, 2025
Affected individuals: 57,253state + nationwide
Data types: Identity (basic)Government IDFinancial accountHealth (basic)PHI
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1119 Automated Collection
Threat actor: External
Regulator citations: Notified federal law enforcementNotified applicable regulatory authoritiesNotified the three major credit reporting agencies
Initial access: exploit_public_facing

During the incident: Initiated incident response procedures
Isolated relevant systems
Launched an investigation to determine the nature and scope of the incident
Reviewed policies, procedures, and processes related to the storage of, and access to, personal information
Working to implement additional safeguards and training to their employees
Provided access to credit monitoring and identity restoration services for one year through IDX
Notified federal law enforcement regarding the incident
Notified applicable regulatory authorities
Notified the three major credit reporting agencies, Equifax, Experian, and TransUnion
Changes made: Reviewing policies, procedures, and processes related to the storage of, and access to, personal information to reduce the likelihood of a similar future incident
Implementing additional safeguards and training to their employees
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 37 weeks(259 days from discovery to filing)
Compliance flags: ME AG ≤30d · 13d
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Scope identified: Dec 17, 2025
→ Filed with AG: Dec 30, 2025
13d 30 days ME AG ≤30d

Statute	Window	Elapsed	Threshold	Status
Maine	Scope identified: Dec 17, 2025 → Filed with AG: Dec 30, 2025	13d	30 days	ME AG ≤30d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

Illinois State AGDec 1 · first

Indiana State AG+29d

Massachusetts State AG+29d

Oregon State AG+29d

Maine State AG+29d · this page

Texas State AG+35d

Pattern: first filing Dec 1 (IL), last Jan 5 (TX) — a 35-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/d4ec48de-1176-4e5c-8236-d09e42f3609a.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 30, 2025
Raw hash: 6849f53039a8a03f6c18491b478d3361ed052db8afdc52325fa1c1a8e44f048d

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entitySSL and ACL

Victim entitySentinel Security Life Insurance Company and Atlantic Coast Life Insurance Company

Incidentdiscovered Apr 15, 2025

Stated responseInitiated incident response procedures

ComplianceME AG ≤30d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov