HackingCustomer Data InvolvedIDENTITY_BASICIDENTITY_GOVERNMENTHighResolved
The Hillman Group
bd_1990bbd539795816 · schema v1 · pii pii-v1
Full breach record for The Hillman Group →The Hillman Group experienced an external system breach (hacking) between May 30 and June 2, 2023, discovered on June 14, 2023. The incident affected 6,410 individuals, including 12 Maine residents. Compromised data included names and Social Security Numbers. The company provided written notification and offered 12 months of Equifax identity protection services.
Maine clockDiscovered Jun 14, 2023 → Filed with AG Nov 7, 2023146d ✗ ME AG >90d21 weeks discovery → filing
⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.
This filing is one of 4 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (3) · sorted by filing gap
- bd_16d6fc8340674ec1Montana State AGfiled 2023-11-07Candidate
- bd_eaea3bd25d9e9144New Hampshire State AGfiled 2023-11-07Verified
- bd_da0bc41c395a5435Vermont State AGfiled 2023-11-06(1d gap)Verified
Source provenance
- Source URL
- https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/ae068d7e-0eaa-4532-a3f6-0f526ec4a9aa.shtml
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Nov 7, 2023
- Raw hash
- 4e30927c1b1c13ec9095e0c5f48034f251abfb9e6b37455a5dc4e2b7c2ea61dd
Reporting entity
- Name
- The Hillman Groupnorm: the hillman
Victim entity
- Name
- The Hillman Groupnorm: the hillman
Incident
- Discovered
- Jun 14, 2023
- Materiality determined
- —
- Notification sent
- Nov 6, 2023
- Affected individuals
- 6,410
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENT
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1190 Exploit Public-Facing Application
- Threat actor
- ExternalFinancial
- Regulator citations
- Filed data breach notice with Maine Attorney General
- Initial access
- exploit_public_facing
Compliance
- Time to disclose
- 21 weeks(146 days from discovery to filing)
- Compliance flags
- ME AG >90d · 146dME resident >60d · 145d
- Discovery-date grounding
- AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.
- Clock breakdown
Statute Window Elapsed Threshold Status Maine Discovered: Jun 14, 2023→ Filed with AG: Nov 7, 2023146d 90 days ME AG >90d Maine Discovered: Jun 14, 2023→ Notified: Nov 6, 2023145d 60 days (analyst band; statutory cap is 30 days) ME resident >60d
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.