HackingCustomer Data InvolvedIDENTITY_BASICLowContained
Joyal Capital Management, LLC
bd_19ace2670edba632 · schema v1 · pii pii-v1
Full breach record for Joyal Capital Management, LLC →Joyal Capital Management, LLC reported an external system breach (hacking) occurring on January 23, 2026, discovered on April 22, 2026. The incident affected 16 individuals, all Maine residents. The entity provided written notification on May 29, 2026, and offered 12 months of credit monitoring and identity theft restoration services through Kroll.
Maine clockDiscovered Apr 22, 2026 → Filed with AG May 29, 202637d ⏱ ME AG >30d5 weeks discovery → filing
⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.
This filing is one of 4 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (3) · sorted by filing gap
- bd_783215e35c839a31Indiana State AGfiled 2026-05-29Verified
- bd_6c4a3c91bfb39a7dVermont State AGfiled 2026-05-30(1d gap)Verified
- bd_b7d127ba290b1f3eNew Hampshire State AGfiled 2026-06-04(6d gap)Candidate
Source provenance
- Source URL
- https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/7f757642-8c12-4236-9ea2-1c8a941485ba.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- May 29, 2026
- Raw hash
- 13f1f231615a9dd7a5a8e1468a5d52386623a0f71aef054b153db7937f073d9e
Reporting entity
- Name
- Constangy, Brooks, Smith & Prophete, LLPnorm: constangy brooks smith prophete
Victim entity
- Name
- Joyal Capital Management, LLCnorm: joyal capital management
- Domain
- joycapmgt.com
- Industry
- financial_services
Incident
- Discovered
- Apr 22, 2026
- Materiality determined
- —
- Notification sent
- May 29, 2026
- Affected individuals
- 16
- Data types
- IDENTITY_BASIC
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1190 Exploit Public-Facing Application
- Threat actor
- External
- Initial access
- exploit_public_facing
Compliance
- Time to disclose
- 5 weeks(37 days from discovery to filing)
- Compliance flags
- ME AG >30d · 37d
- Discovery-date grounding
- AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.
- Clock breakdown
Statute Window Elapsed Threshold Status Maine Discovered: Apr 22, 2026→ Filed with AG: May 29, 202637d 30 days (soft) ME AG >30d
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.