HackingProfessional ServicesProfessional ServicesStolen CredentialsCustomer Data InvolvedDelayed DiscoveryIdentity (basic)Government IDHighActive

One Point HR Solutions, Inc.

bd_0f6b372b3dd4d5fb · schema v1 · pii pii-v1

Severity

High

Discovered

Aug 5, 2024

Filed

Sep 6, 2024

To disclose

5 weeks

Affected · nationwide

13,6822 in this filing

Linked

9 filings

Confidence

66%

Full breach record for One Point HR Solutions, Inc. →

One Point HR Solutions, Inc. reported an external system breach (hacking) affecting 13,682 individuals, including 2 Maine residents. Unauthorized actors accessed email accounts between July 3, 2023, and February 14, 2024. Data potentially exposed included names and Social Security numbers. The breach was discovered on August 5, 2024. Notifications were sent on September 6, 2024. The investigation is ongoing.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Aug 5, 2024 → Filed with AG Sep 6, 202432d ⏱ ME AG >30d5 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 399 days

discovery → filing · 5 weeks / 32 days

Jul 3, 2023

Begins

Aug 5, 2024

Discovered

Sep 6, 2024

Filed

vs. sector median

14 wks faster

This filing is one of 9 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (8) · sorted by filing gap

New Hampshire State AGbd_20065c46365befff2024-09-06Verified
Massachusetts State AGbd_4b9d31a193998e4f2024-09-06Verified
Montana State AGbd_668b3a3ee358d4392024-09-06Candidate
Indiana State AGbd_9c03bb465078bfc42024-09-06Verified

Show 4 more filings ↓up to 35d gap

Vermont State AGbd_546c83680572c5292024-09-05 · +1dVerified
Illinois State AGbd_cdfa4b85eda4e9312024-09-01 · +5dVerified
New Hampshire State AGbd_0086cc962bc729a62024-10-11 · +35dVerified
Maine State AGbd_c44fb15ebe89684a2024-10-11 · +35dVerified

Name: One Point HR Solutions, Inc.
norm: one point hr
Domain: onepointhrs.com

Name: One Point HR Solutions, Inc.
norm: one point hr
Domain: onepointhrs.com
Industry: Professional Servicesllm

Discovered: Aug 5, 2024
Breach occurred: Jul 3, 2023 – Feb 14, 2024
Undetected for: 399 daysoccurrence → discovery
Materiality determined: —
Notification sent: Sep 6, 2024
Affected individuals: 13,682state + nationwide
Data types: Identity (basic)Government ID
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1114 Email Collection
Threat actor: External
Regulator citations: Notified federal and local law enforcement regarding the eventProviding written notice of this incident to relevant state regulators, as necessary, and to the three (3) major credit reporting agencies
Initial access: valid_credentials

During the incident: Engaged third-party forensic and data privacy specialists to investigate the nature and scope of the activity
Undertook a comprehensive and time-intensive review of the potentially impacted data with the assistance of additional data privacy specialists
Notified federal and local law enforcement regarding the event
Providing access to credit monitoring services for twelve (12) months, through IDX, A ZeroFox Company
Providing impacted individuals with guidance on how to better protect against identity theft and fraud
Providing written notice of this incident to relevant state regulators, as necessary, and to the three (3) major credit reporting agencies
Changes made: Implementing additional safeguards and training to its employees
Reviewing existing security policies and have implemented additional cybersecurity measures to further protect against similar events moving forward
Reinforced with our staff the importance of safeguarding information in our care
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 weeks(32 days from discovery to filing)
Compliance flags: ME AG >30d · 32d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Aug 5, 2024
→ Filed with AG: Sep 6, 2024
32d 30 days (soft) ME AG >30d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Aug 5, 2024 → Filed with AG: Sep 6, 2024	32d	30 days (soft)	ME AG >30d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 9 filings · 7 states

View merged incident ↗

Illinois State AGSep 1 · first

Vermont State AG+4d

New Hampshire State AG+5d

Massachusetts State AG+5d

Montana State AG+5d

Indiana State AG+5d

Maine State AG+5d · this page

New Hampshire State AG+40d

Maine State AG+40d

Pattern: first filing Sep 1 (IL), last Oct 11 (ME) — a 40-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/1d70f976-a82c-4ad8-8584-2024152a3984.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 6, 2024
Raw hash: f6f0edcf26fdc5c45e993e129c953ed5ed53cf5871cbf4443cb784ddfb5bff82

Linked disclosures

Regulatory filings (8) · sorted by filing gap

Reporting entityOne Point HR Solutions, Inc.

Victim entityOne Point HR Solutions, Inc.

Incidentdiscovered Aug 5, 2024

Stated responseEngaged third-party forensic and data privacy specialists to investigate the nature and scope of the activity

ComplianceME AG >30d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov