HackingFinancial ServicesFinanceVulnerability ExploitCustomer Data InvolvedIdentity (basic)Government IDHighContained

Evolve Mortgage Services

bd_0e0720d3d54d76bc · schema v1 · pii pii-v1

Severity

High

Discovered

Jan 23, 2026

Filed

Mar 9, 2026

To disclose

6 weeks

Affected · nationwide

4,30915 in this filing

Linked

10 filings

Confidence

66%

Full breach record for Evolve Mortgage Services →

Evolve Mortgage Services, LLC reported an external system breach (hacking) occurring between September 17 and 24, 2025, discovered on January 23, 2026. Approximately 4,309 individuals were affected, including 15 Maine residents. The breach involved personal identifiers and government IDs. Notices were sent in late February/early March 2026, offering 12 months of credit monitoring via TransUnion.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Jan 23, 2026 → Filed with AG Mar 9, 202645d ⏱ ME AG >30d6 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 128 days

discovery → filing · 6 weeks / 45 days

Sep 17, 2025

Begins

Jan 23, 2026

Discovered

Mar 9, 2026

Filed

vs. sector median

2 wks faster

This filing is one of 10 about the same incident.View merged incident

A leak claim by inc_ransom about this victim predates this filing by 129 days.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Siteinc_ransombd_fbf00eab4288c89d2025-10-30 · +130dCandidate

Regulatory filings (8) · sorted by filing gap

New Hampshire State AGbd_5f615dba869fb5382026-03-20 · +11dVerified
Maine State AGbd_8375a654c8d544032026-03-25 · +16dVerified
New Hampshire State AGbd_5b7f7e627b5875532026-02-04 · +33dCandidate
California State AGbd_ccdda7e983fcf53a2026-02-04 · +33dVerified by operator

Show 4 more filings ↓up to 91d gap

Massachusetts State AGbd_d63d1095e7ae97962026-02-04 · +33dVerified by operator
Nebraska State AGbd_df3cffe8e37016c12026-02-03 · +34dVerified
Nebraska State AGbd_e8533bc4021a9b4c2026-02-03 · +34dVerified
South Carolina State AGbd_6f9eeb071263f1fe2025-12-08 · +91dVerified

Name: Cipriani & Werner
norm: cipriani werner
Domain: c-wlaw.com

Name: Evolve Mortgage Services
norm: evolve mortgage
Domain: mrn3.com
Industry: Financial Servicesllm

Discovered: Jan 23, 2026
Breach occurred: Sep 17, 2025 – Sep 24, 2025
Undetected for: 128 daysoccurrence → discovery
Materiality determined: —
Notification sent: Feb 25, 2026
Affected individuals: 4,309state + nationwide
Data types: Identity (basic)Government ID
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: ExternalFinancial
Regulator citations: Filed notification with Maine Attorney General
Initial access: exploit_public_facing

During the incident: Provided 12 months of complimentary credit monitoring and identity protection services through TransUnion/Cyberscout
Sent written notification to affected individuals
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 weeks(45 days from discovery to filing)
Compliance flags: ME AG >30d · 45dLeak >90d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Jan 23, 2026
→ Filed with AG: Mar 9, 2026
45d 30 days (soft) ME AG >30d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Jan 23, 2026 → Filed with AG: Mar 9, 2026	45d	30 days (soft)	ME AG >30d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 9 filings · 6 states

View merged incident ↗

South Carolina State AGDec 8 · first

Nebraska State AG+57d

New Hampshire State AG+58d

California State AG+58d

Massachusetts State AG+58d

Maine State AG+91d · this page

New Hampshire State AG+102d

Maine State AG+107d

Pattern: first filing Dec 8 (SC), last Mar 25 (ME) — a 107-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/2125231e-1105-4d5c-97cf-10d357b30a89.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 9, 2026
Raw hash: 76a872c8d34ce77b4ea81c9bc00e5b79c5c782fdc9d75d956f8621811f82f183

Linked disclosures

Ransomware claims (1)

Regulatory filings (8) · sorted by filing gap

Reporting entityCipriani & Werner

Victim entityEvolve Mortgage Services

Incidentdiscovered Jan 23, 2026

Stated responseProvided 12 months of complimentary credit monitoring and identity protection services through TransUnion/Cyberscout

ComplianceME AG >30d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov