DisclosureLens
HackingFinancial ServicesFinanceCustomer Data InvolvedIdentity (basic)Financial accountFinancial credentialsHigh

Cash Express, LLC

bd_0e7e399d8c663136 · schema v1 · pii pii-v1

Severity

High

Discovered

Aug 4, 2022

Filed

Sep 15, 2022

To disclose

6 weeks

Affected · nationwide

106,5217 in this filing

Linked

5 filings

Confidence

50%
Full breach record for Cash Express, LLC →

Cash Express, LLC, a financial services company, reported a data breach to the Maine Attorney General. The breach, which was discovered on August 4, 2022, and occurred on January 29, 2022, was the result of an external system breach (hacking). The breach affected 7 Maine residents and a total of 106,521 individuals. The information acquired includes names in combination with financial account numbers or credit/debit card numbers (along with security codes, access codes, passwords, or PINs). Cash Express, LLC provided written notification to affected consumers on September 16, 2022, and offered one year of Experian IdentityWorks credit monitoring services.

Maine clockDiscovered Aug 4, 2022 → Filed with AG Sep 15, 202242d ⏱ ME AG >30d6 weeks discovery → filing
⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 187 days
discovery → filing · 6 weeks / 42 days

Jan 29, 2022

Begins

Aug 4, 2022

Discovered

Sep 15, 2022

Filed

vs. sector median

3 wks faster

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Filing propagation · 5 filings · 5 states

View merged incident ↗
Montana State AGSep 15 · first
Maine State AGSep 15 · first · this page
Indiana State AG+1d
New Hampshire State AG+11d
Massachusetts State AG+11d

Pattern: first filing Sep 15 (MT), last Sep 26 (MA) — a 11-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.