HackingOtherCustomer Data InvolvedIdentity (basic)Government IDMediumContained

Baltimore Country Club

bd_1cafdd28e2d6c75b · schema v1 · pii pii-v1

Severity

Medium

Discovered

Feb 1, 2025

Filed

Mar 6, 2025

To disclose

5 weeks

Affected

267state residents only

Linked

6 filings

Confidence

67%

Full breach record for Baltimore Country Club →

Baltimore Country Club, Inc. notified the Maryland Attorney General of a data security incident discovered on February 1, 2025. Unauthorized access to certain files may have exposed names and Social Security numbers of approximately 267 Maryland residents. The club engaged cybersecurity experts, launched a forensic investigation, and mailed notifications offering 12 months of identity protection services.

J jump to incidentP pin to compareR raw source

Maryland clock⏱ MD AG >30d5 weeks discovery → filing

Incident timeline

discovery → filing · 5 weeks / 33 days

Feb 1, 2025

Discovered

Mar 6, 2025

Filed

vs. sector median

3 wks faster

This filing is one of 6 about the same incident.View merged incident

A leak claim by play about this victim predates this filing by 34 days.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Siteplaybd_47fd9f96a7c6ae5b2025-01-31 · +34dVerified by operator

Regulatory filings (4) · sorted by filing gap

Montana State AGbd_0a6bc7cef384ae322025-08-26 · +173dVerified
New Hampshire State AGbd_1eebac0fd17c02ef2025-08-26 · +173dVerified by operator
Indiana State AGbd_af8f8d2c96eb8ca42025-08-26 · +173dVerified
Massachusetts State AGbd_6d164909906e605e2025-08-27 · +174dVerified by operator

Name: Constangy, Brooks, Smith & Prophete, LLP
norm: constangy brooks smith prophete

Name: Baltimore Country Club
norm: baltimore country club
Domain: bcc1898.com
Industry: Otherllm

Discovered: Feb 1, 2025
Materiality determined: —
Notification sent: Mar 6, 2025
Affected individuals: 267state-resident count only
Data types: Identity (basic)Government ID
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: Notified Maryland Attorney General

During the incident: Engaged independent cybersecurity experts to assist with the process
Launched a forensics investigation to determine the source and scope of the compromise
Implemented additional security measures to further harden its digital environment
Notified affected Maryland residents by USPS First Class Mail
Offered 12 months of complimentary identity protection services through IDX
Changes made: Implemented additional security measures to further harden its digital environment
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 weeks(33 days from discovery to filing)
Compliance flags: MD AG >30dLeak >30d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Maryland State AGMar 6 · first · this page

Montana State AG+173d

New Hampshire State AG+173d

Indiana State AG+173d

Massachusetts State AG+174d

Pattern: first filing Mar 6 (MD), last Aug 27 (MA) — a 174-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.maryland.gov/resources-info/SBN%20Documents/2025/ITU-376514.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 6, 2025
Raw hash: fcf5f82899001d43eee12ca8886b0f31222c232be60868168094020ff54cbbed

Linked disclosures

Ransomware claims (1)

Regulatory filings (4) · sorted by filing gap

Reporting entityConstangy, Brooks, Smith & Prophete, LLP

Victim entityBaltimore Country Club

Incidentdiscovered Feb 1, 2025

Stated responseEngaged independent cybersecurity experts to assist with the process

ComplianceMD AG >30d

Extraction provenanceno artifact recorded

Source provenanceoag.maryland.gov