HackingOtherCustomer Data InvolvedIdentity (basic)Government IDPIIHighContained

Transport Workers Union Local 100

bd_20532dbb2095bb16 · schema v1 · pii pii-v1

Severity

High

Discovered

Apr 15, 2026

Filed

Apr 24, 2026

To disclose

9 days

Affected · nationwide

46,4002 in this filing

Confidence

65%

Full breach record for Transport Workers Union Local 100 →2 incidents on file

Transport Workers Union Local 100 experienced an external system breach (hacking) between Jan 29 and Feb 3, 2026. Discovered April 15, 2026. Affected approx. 46,400 individuals, including 2 Maine residents. Data involved: names, DOB, SSNs, health insurance IDs. Notices sent April 24, 2026. IDX identity protection offered.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Apr 15, 2026 → Filed with AG Apr 24, 20269d ✓ ME AG ≤30d9 days discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 76 days

discovery → filing · 9 days

Jan 29, 2026

Begins

Apr 15, 2026

Discovered

Apr 24, 2026

Filed

vs. sector median

5 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed46,400 affectedView incident

Name: Transport Workers Union Local 100
norm: transport workers union local 100

Name: Transport Workers Union Local 100
norm: transport workers union local 100
Industry: Otherllm

Discovered: Apr 15, 2026
Breach occurred: Jan 29, 2026 – Feb 3, 2026
Undetected for: 76 daysoccurrence → discovery
Materiality determined: —
Notification sent: Apr 24, 2026
Affected individuals: 46,400state + nationwide
Data types: Identity (basic)Government IDPII
Data elements: Date of birth
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1119 Automated Collection
Threat actor: External
Initial access: exploit_public_facing

During the incident: Undertook a review, working with third-party experts, to determine the nature and scope of the unauthorized access and confirm it was contained
Implemented additional security measures to help further protect against this type of incident going forward
Offering complimentary access to identity theft protection services through IDX at no cost to you
Changes made: Implemented additional security measures to help further protect against this type of incident going forward
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 9 days(9 days from discovery to filing)
Compliance flags: ME AG ≤30d · 9d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Apr 15, 2026
→ Filed with AG: Apr 24, 2026
9d 30 days ME AG ≤30d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Apr 15, 2026 → Filed with AG: Apr 24, 2026	9d	30 days	ME AG ≤30d

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/df8be32e-0188-4383-bb85-7b05ba8bfbad.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 24, 2026
Raw hash: 06ffb91b94cb5d8276d349f38cda67051048b9242d8899d7a20ae5f29cd749fb

Reporting entityTransport Workers Union Local 100

Victim entityTransport Workers Union Local 100

Incidentdiscovered Apr 15, 2026

Stated responseUndertook a review, working with third-party experts, to determine the nature and scope of the unauthorized access and confirm it was contained

ComplianceME AG ≤30d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov