HackingGovernmentGovernmentStolen CredentialsData ExfiltratedCustomer Data InvolvedDelayed DiscoveryPIILowContained
City of New Brighton
bd_1778c372dad776da · schema v1 · pii pii-v1
Full breach record for City of New Brighton →City of New Brighton, MN (a government entity) experienced unauthorized access to a limited number of employee email accounts between approximately May 29, 2025 and June 18, 2025. The breach was detected on or about June 16, 2025. A forensic investigation concluded on or about September 18, 2025 that personal information may have been acquired. Total affected: 5,940 individuals; 1 Maine resident. No identity theft protection services were offered.
Maine clockDiscovered Jun 18, 2025 → Filed with AG Oct 20, 2025124d ✗ ME AG >90d18 weeks discovery → filing
⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
This filing is one of 2 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (1) · sorted by filing gap
- bd_8bd40b077c12ac37Indiana State AGfiled 2025-10-17(3d gap)Verified
Source provenance
- Source URL
- https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/17880e51-d16f-4bf6-bd14-4a8bc1a1644c.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Oct 20, 2025
- Raw hash
- c93372d8abb2a9c7f547b6f93d2175ab930ffd35eb47e2a5b7e0cada52edf2fb
Reporting entity
- Name
- City of New Brightonnorm: city of new brighton
- Domain
- newbrightonmn.gov
- Industry
- Other Government Entity
Victim entity
- Name
- City of New Brightonnorm: city of new brighton
- Domain
- newbrightonmn.gov
- Industry
- Other Government Entity
- Industry
- Governmentllm
Incident
- Discovered
- Jun 18, 2025
- Materiality determined
- —
- Notification sent
- Oct 17, 2025
- Affected individuals
- 1
- Data types
- PII
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1078 Valid AccountsT1114 Email Collection
- Threat actor
- External
Compliance
- Time to disclose
- 18 weeks(124 days from discovery to filing)
- Compliance flags
- ME AG >90d · 124dME resident >60d · 121d
- Discovery-date grounding
- unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
- Clock breakdown
Statute Window Elapsed Threshold Status Maine Discovered: Jun 18, 2025→ Filed with AG: Oct 20, 2025124d 90 days ME AG >90d Maine Discovered: Jun 18, 2025→ Notified: Oct 17, 2025121d 60 days (analyst band; statutory cap is 30 days) ME resident >60d
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.