MalwareRetail & ConsumerRetailRansomwareData EncryptedRansom DemandedData ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDMediumContained

Graphique de France

bd_1146eb4d0e4bb50c · schema v1 · pii pii-v1

Severity

Medium

Discovered

Nov 18, 2024

Filed

Nov 27, 2024

To disclose

9 days

Affected · nationwide

3521 in this filing

Linked

3 filings

Confidence

66%

Full breach record for Graphique de France →2 incidents on file

Graphique De France LTD reported a data breach affecting 352 individuals, including 1 Maine resident. Unauthorized access occurred between September 20 and October 6, 2024, involving an encryption event (ransomware) and potential data exfiltration. Affected data included names and Social Security Numbers. Graphique engaged forensic experts, notified the FBI, and provided 12 months of credit monitoring via IDX. Notices were sent on November 27, 2024.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Nov 18, 2024 → Filed with AG Nov 27, 20249d ✓ ME AG ≤30d9 days discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 59 days

discovery → filing · 9 days

Sep 20, 2024

Begins

Nov 18, 2024

Discovered

Nov 27, 2024

Filed

vs. sector median

6 wks faster

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

New Hampshire State AGbd_1ac299fefed0c8ea2024-11-27Candidate
Massachusetts State AGbd_34dbb08a644826442024-11-27Verified

Name: Constangy, Brooks, Smith & Prophete, LLP
norm: constangy brooks smith prophete

Name: Graphique de France
norm: graphique de france
Domain: graphiquedefrance.com
Industry: Retail & Consumerllm

Discovered: Nov 18, 2024
Breach occurred: Sep 20, 2024 – Oct 6, 2024
Undetected for: 59 daysoccurrence → discovery
Materiality determined: —
Notification sent: Nov 27, 2024
Affected individuals: 352state + nationwide
Data types: Identity (basic)Government ID
Data elements: Social Security number
Attack vector: Unauthorized Access
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Notified Maine Attorney General's OfficeReported the incident to the Federal Bureau of Investigation

During the incident: Engaged independent cybersecurity experts to investigate the matter
Took steps to secure the environment
Reported the incident to the Federal Bureau of Investigation
Established a toll-free call center through IDX
Providing complimentary identity protection services to all notified individuals
Changes made: Implemented additional safeguards to help ensure the security of its environment
Implemented additional advanced technical security measures and monitoring
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 9 days(9 days from discovery to filing)
Compliance flags: ME AG ≤30d · 9d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Nov 18, 2024
→ Filed with AG: Nov 27, 2024
9d 30 days ME AG ≤30d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Nov 18, 2024 → Filed with AG: Nov 27, 2024	9d	30 days	ME AG ≤30d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

New Hampshire State AGNov 27 · first

Massachusetts State AGNov 27 · first

Maine State AGNov 27 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/1bf527d2-eb05-4d4e-ae88-5819f5773ad6.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 27, 2024
Raw hash: 9ee2f1ef6daa0994da9613052d9c77d4aae3686cc66047501832c92d2027a3d5

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityConstangy, Brooks, Smith & Prophete, LLP

Victim entityGraphique de France

Incidentdiscovered Nov 18, 2024

Stated responseEngaged independent cybersecurity experts to investigate the matter

ComplianceME AG ≤30d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov