HackingOtherCustomer Data InvolvedIdentity (basic)Government IDHighContained

FARMERS' RICE COOPERATIVE

bd_23caec4049c36838 · schema v1 · pii pii-v1

Severity

High

Discovered

May 29, 2025

Filed

Aug 20, 2025

To disclose

12 weeks

Affected · nationwide

4,2101 in this filing

Linked

6 filings

Confidence

65%

Full breach record for FARMERS' RICE COOPERATIVE →

Farmer's Rice Cooperative reported an external system breach (hacking) occurring August 30-September 2, 2024, discovered May 29, 2025. The incident affected 4,210 Maine residents and 1 individual nationwide. Personal information including names and government identifiers was potentially compromised. The company engaged a cybersecurity firm, notified law enforcement, and provided 24 months of IDX identity protection services to affected individuals.

J jump to incidentP pin to compareR raw source

Leak gap clock✗ Leak >180d12 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 272 days

discovery → filing · 12 weeks / 83 days

Aug 30, 2024

Begins

May 29, 2025

Discovered

Aug 20, 2025

Filed

vs. sector median

+4 wks slower

This filing is one of 6 about the same incident.View merged incident

A leak claim by play about this victim predates this filing by 355 days.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Siteplaybd_ba7cdfe100b5454f2024-08-30 · +355dVerified by operator

Regulatory filings (4) · sorted by filing gap

Montana State AGbd_61ac6d84feb099832025-08-20Verified
California State AGbd_c6bf2ce7d83f71a62025-08-19 · +1dCandidate
New Hampshire State AGbd_464d761d2e5aa9b92025-08-22 · +2dVerified
Indiana State AGbd_c14af2a469730cc02025-07-01 · +50dVerified

Name: FARMERS' RICE COOPERATIVE
norm: farmers rice cooperative
Domain: farmersrice.com

Name: FARMERS' RICE COOPERATIVE
norm: farmers rice cooperative
Domain: farmersrice.com
Industry: Otherllm

Discovered: May 29, 2025
Breach occurred: Aug 30, 2024 – Sep 2, 2024
Undetected for: 272 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jul 1, 2025
Affected individuals: 4,210state + nationwide
Data types: Identity (basic)Government ID
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1078 Valid Accounts
Threat actor: External
Regulator citations: Notified Maine Attorney General
Initial access: exploit_public_facing

During the incident: Launched an investigation
Engaged a national cybersecurity firm to assist in assessing the scope of the incident
Took steps to mitigate the potential impact to our community
Notified law enforcement
Changes made: Evaluating opportunities to further secure our systems to prevent a similar event from occurring again in the future
Arranged for you to activate, at no cost to you, IDX identity protection services which includes 24 months of credit and CyberScan monitoring, a $1,000,000 insurance reimbursement policy, and fully managed ID theft recovery services
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 12 weeks(83 days from discovery to filing)
Compliance flags: Leak >180dME AG >30d · 83d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: May 29, 2025
→ Filed with AG: Aug 20, 2025
83d 30 days (soft) ME AG >30d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: May 29, 2025 → Filed with AG: Aug 20, 2025	83d	30 days (soft)	ME AG >30d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Indiana State AGJul 1 · first

California State AG+49d

Montana State AG+50d

Maine State AG+50d · this page

New Hampshire State AG+52d

Pattern: first filing Jul 1 (IN), last Aug 22 (NH) — a 52-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/81da24e1-91c1-4ac0-893b-124270d70eca.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 20, 2025
Raw hash: 45c0276b0dc54bd93fcbf41592c0fae64e0322e3d8f379405d4ed433052dacc5

Linked disclosures

Ransomware claims (1)

Regulatory filings (4) · sorted by filing gap

Reporting entityFARMERS' RICE COOPERATIVE

Victim entityFARMERS' RICE COOPERATIVE

Incidentdiscovered May 29, 2025

Stated responseLaunched an investigation

ComplianceLeak >180d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov