HackingManufacturingTransportation & LogisticsManufacturingVulnerability ExploitN-DayData ExfiltratedTargetedGovernment IDIdentity (basic)HighContained

LKQ CORPORATION

bd_222597b2166e9a95 · schema v1 · pii pii-v1

Severity

High

Discovered

Oct 3, 2025

Filed

Dec 15, 2025

To disclose

10 weeks

Affected · nationwide

9,07031 in this filing

Linked

11 filings

Confidence

65%

Full breach record for LKQ CORPORATION →3 incidents on file

LKQ Corporation reported an external system breach (hacking) affecting 9,070 individuals, including 31 Maine residents. The breach involved the exploitation of vulnerabilities in Oracle E-Business Suite, leading to unauthorized access and exfiltration of personal information (SSN/EIN) from sole proprietor suppliers. The incident was discovered on October 3, 2025, and notifications were sent on December 15, 2025. LKQ engaged forensic investigators, took systems offline, and offered 24 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Oct 3, 2025 → Filed with AG Dec 15, 202573d ⏱ ME AG >30d10 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 55 days

discovery → filing · 10 weeks / 73 days

Aug 9, 2025

Begins

Oct 3, 2025

Discovered

Dec 15, 2025

Filed

vs. sector median

on median

This filing is one of 11 about the same incident.View merged incident

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Sitecl0pbd_ca963b548e29a5612025-10-27 · +49dVerified by operator

Regulatory filings (9) · sorted by filing gap

Indiana State AGbd_0d24498ef978ea452025-12-15Verified
Montana State AGbd_3b11067f5766d01d2025-12-15Verified
New Hampshire State AGbd_6c3aa51f5e66e7ed2025-12-15Verified
Nebraska State AGbd_a883eb69b4b810b72025-12-15Verified

Show 5 more filings ↓up to 14d gap

Vermont State AGbd_e09da3b67b0dfe832025-12-15Verified
California State AGbd_f78e0c2f9e23cbd92025-12-15Verified
Massachusetts State AGbd_6b3dcc0a0ce73b642025-12-16 · +1dVerified
Texas State AGbd_9f980168ee3c217d2025-12-16 · +1dVerified
Illinois State AGbd_290f5cb85d1397ca2025-12-01 · +14dCandidate

Name: LKQ CORPORATION
norm: lkq
Domain: lkqcorp.com

Name: LKQ CORPORATION
norm: lkq
Domain: lkqcorp.com
Industry: ManufacturingllmTransportation & Logisticsllm

Discovered: Oct 3, 2025
Breach occurred: Aug 9, 2025
Undetected for: 55 daysoccurrence → discovery
Materiality determined: —
Notification sent: Dec 15, 2025
Affected individuals: 9,070state + nationwide
Data types: Government IDIdentity (basic)
Data elements: Social Security number
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1078 Valid Accounts
Threat actor: ExternalFinancial
Initial access: exploit_public_facing

During the incident: Launched an investigation with assistance from a third-party forensic firm
Took the system offline
Deployed additional safeguards onto our systems
Reinforced security practices
Enhanced security monitoring and controls
Offered two years of complimentary credit monitoring and identity restoration services
Changes made: Reinforced security practices
Enhanced security monitoring and controls
Regularly review security and privacy policies and procedures
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 10 weeks(73 days from discovery to filing)
Compliance flags: ME AG >30d · 73dLeak >30d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Oct 3, 2025
→ Filed with AG: Dec 15, 2025
73d 30 days (soft) ME AG >30d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Oct 3, 2025 → Filed with AG: Dec 15, 2025	73d	30 days (soft)	ME AG >30d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 10 filings · 10 states

View merged incident ↗

Illinois State AGDec 1 · first

Indiana State AG+14d

Montana State AG+14d

New Hampshire State AG+14d

Nebraska State AG+14d

Vermont State AG+14d

California State AG+14d

Maine State AG+14d · this page

Massachusetts State AG+15d

Texas State AG+15d

Pattern: first filing Dec 1 (IL), last Dec 16 (TX) — a 15-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/0f46ebfd-5508-426d-88f9-3ad07e6ef483.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 15, 2025
Raw hash: aa020547b67b0dbca244dccc89834773ca4c7af9d6e746acc49b78182a704051

Linked disclosures

Ransomware claims (1)

Regulatory filings (9) · sorted by filing gap

Reporting entityLKQ CORPORATION

Victim entityLKQ CORPORATION

Incidentdiscovered Oct 3, 2025

Stated responseLaunched an investigation with assistance from a third-party forensic firm

ComplianceME AG >30d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov