HackingOtherData ExfiltratedTargetedIdentity (basic)Government IDFinancial accountHighContained

The Walters Art Museum

bd_1d0cc9c91a47089e · schema v1 · pii pii-v1

Severity

High

Discovered

Aug 28, 2024

Filed

Sep 27, 2024

To disclose

4 weeks

Affected · nationwide

5,47210 in this filing

Linked

5 filings

Confidence

66%

Full breach record for The Walters Art Museum →

The Walters Art Museum experienced an external system breach (hacking) between Oct 10 and Nov 18, 2023. Unauthorized access affected personal info including SSNs, driver's licenses, and financial account details. 5,472 Maine residents were notified on Sep 27, 2024. The museum engaged forensic specialists, notified law enforcement, and provided 12 months of credit monitoring via Experian.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Aug 28, 2024 → Filed with AG Sep 27, 202430d ✓ ME AG ≤30d4 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 323 days

discovery → filing · 4 weeks / 30 days

Oct 10, 2023

Begins

Aug 28, 2024

Discovered

Sep 27, 2024

Filed

vs. sector median

2 wks faster

This filing is one of 5 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Vermont State AGbd_425023d2d278c0f92024-09-27Verified
Montana State AGbd_7257c63a9f5d3b982024-09-27Verified by operator
Indiana State AGbd_8b413c731a27125d2024-09-27Verified
New Hampshire State AGbd_b011fe186a7b076f2024-09-27Verified

Name: The Walters Art Museum
norm: the walters art museum
Domain: thewalters.org

Name: The Walters Art Museum
norm: the walters art museum
Domain: thewalters.org
Also named: The Trustees of the Walters Art Gallery, Inc.dba oflegal entity
the Walters Art Museumdba oftrade name
Industry: Otherllm

Discovered: Aug 28, 2024
Breach occurred: Oct 10, 2023 – Nov 18, 2023
Undetected for: 323 daysoccurrence → discovery
Materiality determined: —
Notification sent: Sep 27, 2024
Affected individuals: 5,472state + nationwide
Data types: Identity (basic)Government IDFinancial account
Data elements: Social Security number
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1078 Valid Accounts
Threat actor: External
Regulator citations: notified federal law enforcement regarding the eventproviding written notice of this incident to event state regulators
Initial access: exploit_public_facing

During the incident: Investigated and responded to it
Assessed the security of its network
Notified potentially affected individuals
Notified federal law enforcement regarding the event
Providing access to credit monitoring services for twelve (12) months, through Experian
Providing impacted individuals with guidance on how to better protect against identity theft and fraud
Providing written notice of this incident to event state regulators
Providing written notice of this incident to the three (3) major credit reporting agencies
Changes made: Regularly reviews and enhances its existing policies and procedures related to data privacy to reduce the likelihood of a similar event reoccurring in the future
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 4 weeks(30 days from discovery to filing)
Compliance flags: ME AG ≤30d · 30d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Aug 28, 2024
→ Filed with AG: Sep 27, 2024
30d 30 days ME AG ≤30d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Aug 28, 2024 → Filed with AG: Sep 27, 2024	30d	30 days	ME AG ≤30d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Vermont State AGSep 27 · first

Montana State AGSep 27 · first

Indiana State AGSep 27 · first

New Hampshire State AGSep 27 · first

Maine State AGSep 27 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/106effe5-1adf-43dc-a2af-d8efeba9f410.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 27, 2024
Raw hash: 67fbd9b90690c8be20fd3e791c8798b3b9a412fac4610235d6e15d7ba35088ac

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityThe Walters Art Museum

Victim entityThe Walters Art Museum

Incidentdiscovered Aug 28, 2024

Stated responseInvestigated and responded to it

ComplianceME AG ≤30d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov