Social EngineeringPhishingCustomer Data InvolvedIdentity (basic)Government IDMediumContained

KERECIS ehf.

bd_18383d4311ef6121 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Mar 31, 2023

Filed

May 2, 2023

To disclose

5 weeks

Affected · nationwide

3551 in this filing

Confidence

50%

Full breach record for KERECIS ehf. →

Kerecis LLC reported a data breach to the Maine Attorney General, indicating that a phishing attack resulted in the compromise of personal information. The incident occurred on February 24, 2023, and was discovered on March 31, 2023. One Maine resident was affected, out of a total of 355 individuals. The compromised data included names and Social Security Numbers. Kerecis began notifying affected individuals on May 2, 2023, and offered 24 months of credit monitoring services through Experian.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Mar 31, 2023 → Filed with AG May 2, 202332d ⏱ ME AG >30d5 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 35 days

discovery → filing · 5 weeks / 32 days

Feb 24, 2023

Begins

Mar 31, 2023

Discovered

May 2, 2023

Filed

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed355 affectedView incident

Name: KERECIS ehf.
norm: kerecis ehf-is

Name: KERECIS ehf.
norm: kerecis ehf-is

Discovered: Mar 31, 2023
Breach occurred: Feb 24, 2023
Undetected for: 35 daysoccurrence → discovery
Materiality determined: —
Notification sent: May 2, 2023
Affected individuals: 355state + nationwide
Data types: Identity (basic)Government ID
Data elements: Social Security number
Attack vector: Phishing

Changes made: Offered 24 months of free credit monitoring services through Experian IdentityWorks.
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 weeks(32 days from discovery to filing)
Compliance flags: ME AG >30d · 32d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Mar 31, 2023
→ Filed with AG: May 2, 2023
32d 30 days (soft) ME AG >30d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Mar 31, 2023 → Filed with AG: May 2, 2023	32d	30 days (soft)	ME AG >30d

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/70260d57-27f6-4f70-9091-38a0925fe687.shtml
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 2, 2023
Raw hash: 0c6c5bc91a66551ab33c6f93d6913b28b8e69140f43ca848575c1b22c7f28c9f

Reporting entityKERECIS ehf.

Victim entityKERECIS ehf.

Incidentdiscovered Mar 31, 2023

Stated responseOffered 24 months of free credit monitoring services through Experian IdentityWorks.

ComplianceME AG >30d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov