HackingFinancial ServicesTechnologyFinanceData ExfiltratedCustomer Data InvolvedIdentity (basic)LowContained

Ingo Money

bd_10f7c83fa3539c48 · schema v1 · pii pii-v1

Severity

Low

Discovered

Nov 23, 2023

Filed

Aug 5, 2024

To disclose

37 weeks

Affected

111state residents only

Linked

7 filings

Confidence

66%

Full breach record for Ingo Money →

Ingo Money, Inc. reported an external system breach (hacking) on November 23, 2023, affecting 111 individuals, including 111 Maine residents. The incident involved the unauthorized removal of personal information (names and other identifiers) from a limited portion of its corporate network. Ingo Money engaged outside cyber professionals, notified law enforcement, and enhanced system security. Affected individuals were notified electronically on June 26, 2024, and offered 12 months of credit monitoring and identity protection services through Kroll.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Nov 23, 2023 → Filed with AG Aug 5, 2024256d ✗ ME AG >90d37 weeks discovery → filing

⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Incident timeline

discovery → filing · 37 weeks / 256 days

Nov 23, 2023

Begins

Nov 23, 2023

Discovered

Aug 5, 2024

Filed

vs. sector median

+28 wks slower

This filing is one of 7 about the same incident.View merged incident

A leak claim by inc_ransom about this victim predates this filing by 256 days.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Siteinc_ransombd_d5319e025594e9522023-11-23 · +256dVerified

Regulatory filings (5) · sorted by filing gap

California State AGbd_9aca85417932278e2024-08-07 · +2dVerified
Massachusetts State AGbd_5fad210b837d2a462024-07-08 · +28dVerified
Washington State AGbd_d33dcc1e99dcc9cb2024-07-02 · +34dVerified
Massachusetts State AGbd_591665c46a2cdd4d2024-06-29 · +37dVerified

Show 1 more filing ↓up to 40d gap

Indiana State AGbd_07deaf206dcd878a2024-06-26 · +40dCandidate

Name: Nelson Mullins Riley & Scarborough LLP
norm: nelson mullins riley scarborough

Name: Ingo Money
norm: ingo money
Domain: ingomoney.com
Industry: Financial ServicesllmTechnologyllm

Discovered: Nov 23, 2023
Breach occurred: Nov 23, 2023
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jun 26, 2024
Affected individuals: 111state-resident count only
Data types: Identity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1041 Exfiltration Over C2 Channel
Threat actor: External
Initial access: exploit_public_facing

During the incident: Outside cyber professionals promptly investigated
Outside technical experts were engaged and further enhanced the security of our systems
Law enforcement was notified
Security team and third-party cyber professionals will continue to closely monitor our systems 24/7/365 for any unusual activity
Changes made: Enhanced the security of our systems
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 37 weeks(256 days from discovery to filing)
Compliance flags: ME AG >90d · 256dME resident >180d · 216dLeak >180d
Discovery-date grounding: occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Nov 23, 2023
→ Filed with AG: Aug 5, 2024
256d 90 days ME AG >90d
Maine
Discovered: Nov 23, 2023
→ Notified: Jun 26, 2024
216d 180 days ME resident >180d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Nov 23, 2023 → Filed with AG: Aug 5, 2024	256d	90 days	ME AG >90d
Maine	Discovered: Nov 23, 2023 → Notified: Jun 26, 2024	216d	180 days	ME resident >180d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 5 states

View merged incident ↗

Indiana State AGJun 26 · first

Massachusetts State AG+3d

Washington State AG+6d

Massachusetts State AG+12d

Maine State AG+40d · this page

California State AG+42d

Pattern: first filing Jun 26 (IN), last Aug 7 (CA) — a 42-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/a98ba5de-6ab0-4419-9c84-78fc1bfda04c.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 5, 2024
Raw hash: 85400e9a54a2118f3588e0d1d0cd134520ad089e320661182b97e9ed3707594f

Linked disclosures

Ransomware claims (1)

Regulatory filings (5) · sorted by filing gap

Reporting entityNelson Mullins Riley & Scarborough LLP

Victim entityIngo Money

Incidentdiscovered Nov 23, 2023

Stated responseOutside cyber professionals promptly investigated

ComplianceME AG >90d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov