MalwareFinancial ServicesHealthcareFinanceRansomwareBianLianRansom DemandedRansom PaidData ExfiltratedData EncryptedCustomer Data InvolvedEmployee Data InvolvedTargetedIdentity (basic)Government IDFinancial accountHealth (basic)PHIHighContained

BBS Financial Services, LLC

bd_19b6ae23508a8036 · schema v1 · pii pii-v1

Severity

High

Discovered

Jan 29, 2024

Filed

Nov 11, 2024

To disclose

41 weeks

Affected · nationwide

70,1681,404 in this filing

Linked

5 filings

Confidence

66%

Full breach record for BBS Financial Services, LLC →

BBS Financial Services, LLC reported a ransomware incident where the threat actor BianLian exfiltrated data from its network. The breach affected approximately 70,168 individuals, including 1,404 Maine residents. Compromised data included tax records, payroll information, and medical billing records containing PII, SSNs, financial account numbers, and PHI. BBS paid a ransom and provided 2 years of credit monitoring to affected individuals.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Jan 29, 2024 → Filed with AG Nov 11, 2024287d ✗ ME AG >90d41 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 41 days

discovery → filing · 41 weeks / 287 days

Dec 19, 2023

Begins

Jan 29, 2024

Discovered

Nov 11, 2024

Filed

vs. sector median

+32 wks slower

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

California State AGbd_055878f91c03cfc42024-11-11Verified
Montana State AGbd_1da1372591c522652024-11-11Verified
Massachusetts State AGbd_411aa04bdea46b162024-11-11Verified
Indiana State AGbd_f7c771b45c51aa8c2024-06-18 · +146dCandidate

Name: MCLANE MIDDLETON, PROFESSIONAL ASSOCIATION
norm: mclane middleton professional

Name: BBS Financial Services, LLC
norm: bbs financial
Domain: bbs1040.com
Industry: Financial ServicesllmHealthcarellm

Discovered: Jan 29, 2024
Breach occurred: Dec 19, 2023
Undetected for: 41 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jun 18, 2024
Affected individuals: 70,168state + nationwide
Data types: Identity (basic)Government IDFinancial accountHealth (basic)PHI
Attack vector: Unauthorized Access
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 ChannelT1190 Exploit Public-Facing Application
Threat actor: BianLianExternalFinancial
Regulator citations: Filed a report with the FBIContacted the cybersecurity division of the Internal Revenue ServiceFiled a report through IC3.com
Initial access: exploit_public_facing

During the incident: Shut down its network
Engaged cybersecurity counsel and a forensic expert to investigate
Negotiated and paid a ransom
Obtained credible evidence of the destruction of all data exfiltrated from its network
Monitored the dark web
Contacted the cybersecurity division of the Internal Revenue Service
Filed a report about the breach through IC3.com
Filed a report with the FBI
Changes made: Initiated safeguards to mitigate the potential filing of fraudulent tax returns under the Return Integrity Compliance Services program
Offered 2 years of identity and credit monitoring and restoration services through Equifax
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 41 weeks(287 days from discovery to filing)
Compliance flags: ME AG >90d · 287dME resident >60d · 141dME CRA notice due
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Jan 29, 2024
→ Filed with AG: Nov 11, 2024
287d 90 days ME AG >90d
Maine
Discovered: Jan 29, 2024
→ Notified: Jun 18, 2024
141d 60 days (analyst band; statutory cap is 30 days) ME resident >60d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Jan 29, 2024 → Filed with AG: Nov 11, 2024	287d	90 days	ME AG >90d
Maine	Discovered: Jan 29, 2024 → Notified: Jun 18, 2024	141d	60 days (analyst band; statutory cap is 30 days)	ME resident >60d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Indiana State AGJun 18 · first

California State AG+146d

Montana State AG+146d

Massachusetts State AG+146d

Maine State AG+146d · this page

Pattern: first filing Jun 18 (IN), last Nov 11 (ME) — a 146-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/77c00f4d-9eb4-44e0-bcd4-a8aed40e770e.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 11, 2024
Raw hash: aa5a034e8952db45e20da2bcfa810e9d2bdf8b59f7a4894f32c01eb87b459339

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityMCLANE MIDDLETON, PROFESSIONAL ASSOCIATION

Victim entityBBS Financial Services, LLC

Incidentdiscovered Jan 29, 2024

Stated responseShut down its network

ComplianceME AG >90d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov