HackingCustomer Data InvolvedDownstream VictimsSupply Chain (3P Vendor)Identity (basic)Government IDHigh

Bradford-Scott Data, LLC

bd_178e113b4b0ac84b · schema v1 · pii pii-v1

Severity

High

Discovered

Dec 10, 2023

Filed

Feb 29, 2024

To disclose

12 weeks

Affected · nationwide

35,73636 in this filing

Linked

6 filings

Confidence

75%

Full breach record for Bradford-Scott Data, LLC →2 incidents on file

Bradford-Scott Data, LLC, a service provider, experienced an external system breach on May 19, 2023, discovered on December 10, 2023. The incident affected 36 Maine residents, compromising their names and Social Security numbers. The company notified the affected individuals on February 26-27, 2024, and offered 12 months of identity theft protection services through IDX.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Dec 10, 2023 → Filed with AG Feb 29, 202481d ⏱ ME AG >30d12 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 205 days

discovery → filing · 12 weeks / 81 days

May 19, 2023

Begins

Dec 10, 2023

Discovered

Feb 29, 2024

Filed

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Massachusetts State AGbd_ebbdd3ce9fe0e7012024-02-29Verified
Vermont State AGbd_ede992a2e69ee4742024-02-26 · +3dVerified
Vermont State AGbd_54ffd876b9c5203f2024-03-08 · +8dVerified
Vermont State AGbd_82d291952b7b7f622024-03-08 · +8dVerified

Show 1 more filing ↓up to 16d gap

Montana State AGbd_24f935a59c16271e2024-02-13 · +16dCandidate

Name: Bradford-Scott Data, LLC
norm: bradford scott data

Name: Bradford-Scott Data, LLC
norm: bradford scott data

Discovered: Dec 10, 2023
Breach occurred: May 19, 2023
Undetected for: 205 daysoccurrence → discovery
Materiality determined: —
Notification sent: Feb 26, 2024
Affected individuals: 35,736state + nationwide
Data types: Identity (basic)Government ID
Data elements: Social Security number
Attack vector: Unauthorized Access

Changes made: Offered 12 months of identity theft protection services from IDX.
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 12 weeks(81 days from discovery to filing)
Compliance flags: ME AG >30d · 81dME resident >60d · 78d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Dec 10, 2023
→ Filed with AG: Feb 29, 2024
81d 30 days (soft) ME AG >30d
Maine
Discovered: Dec 10, 2023
→ Notified: Feb 26, 2024
78d 60 days (analyst band; statutory cap is 30 days) ME resident >60d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Dec 10, 2023 → Filed with AG: Feb 29, 2024	81d	30 days (soft)	ME AG >30d
Maine	Discovered: Dec 10, 2023 → Notified: Feb 26, 2024	78d	60 days (analyst band; statutory cap is 30 days)	ME resident >60d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 4 states

View merged incident ↗

Montana State AGFeb 13 · first

Vermont State AG+13d

Massachusetts State AG+16d

Maine State AG+16d · this page

Vermont State AG+24d

Pattern: first filing Feb 13 (MT), last Mar 8 (VT) — a 24-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/b196c9ad-906f-48bf-b8ce-46f2cc174774.shtml
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 29, 2024
Raw hash: a5e264d848ce800c85ca0a2756ae38cd1feda63bf680884b83b7f6450a0e9deb

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityBradford-Scott Data, LLC

Victim entityBradford-Scott Data, LLC

Incidentdiscovered Dec 10, 2023

Stated responseOffered 12 months of identity theft protection services from IDX.

ComplianceME AG >30d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov