HackingFinancial ServicesFinanceStolen CredentialsCustomer Data InvolvedGovernment IDFinancial accountMediumContained

UNIVERSAL LENDERS, LLC

bd_28bfcd45a014e0ef · schema v1 · pii pii-v1

Severity

Medium

Discovered

Nov 7, 2024

Filed

Nov 13, 2025

To disclose

—

Affected

119state residents only

Linked

9 filings

Confidence

66%

Full breach record for UNIVERSAL LENDERS, LLC →

Universal Lenders, LLC reported a data security incident to the Maryland Attorney General on January 21, 2025. Unauthorized access occurred on November 7, 2024, and was detected on December 5, 2024. The breach affected approximately 119 Maryland residents, exposing Social Security numbers, financial account numbers, and driver's license information. Universal Lenders engaged independent cybersecurity experts, notified affected individuals, and offered complimentary identity protection services.

J jump to incidentP pin to compareR raw source

Incident timeline

Nov 7, 2024

Begins

Nov 7, 2024

Discovered

Nov 13, 2025

Filed

This filing is one of 9 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (8) · sorted by filing gap

Massachusetts State AGbd_8681187fbd5b2a582025-01-24 · +293dVerified
Maine State AGbd_1cb830ed8c7ee3ab2025-01-23 · +294dVerified
Montana State AGbd_2246d9821e08d0132025-01-21 · +296dVerified
Vermont State AGbd_59557d9054371af22025-01-21 · +296dVerified

Show 4 more filings ↓up to 316d gap

Nebraska State AGbd_5cdd29de26a76f102025-01-21 · +296dVerified
New Hampshire State AGbd_9429214e64f174362025-01-21 · +296dVerified
Indiana State AGbd_e62d03a0b7d283292025-01-21 · +296dVerified
Illinois State AGbd_917f88c6036f66ee2025-01-01 · +316dCandidate

Name: Constangy, Brooks, Smith & Prophete, LLP
norm: constangy brooks smith prophete

Name: UNIVERSAL LENDERS, LLC
norm: universal lenders
Industry: Financial Servicesllm

Discovered: Nov 7, 2024
Breach occurred: Nov 7, 2024
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jan 21, 2025
Affected individuals: 119state-resident count only
Data types: Government IDIdentity (basic)Financial account
Data elements: Social Security number
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: Notified Maryland Attorney General
Initial access: valid_credentials

During the incident: Initiated an investigation of the matter with the help of independent cybersecurity experts
Undertook a comprehensive review of those files
Took immediate steps to evaluate and improve the security of its systems
Established a toll-free call center through IDX to answer questions about the incident
Notified the potentially affected individuals
Reported the incident to nationwide consumer reporting agencies (i.e., Equifax, Experian, and Transunion)
Changes made: Continue to evaluate additional protections that can be put into place to supplement its existing security policies and procedures
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 9 filings · 9 states

View merged incident ↗

Illinois State AGJan 1 · first

Montana State AG+20d

Vermont State AG+20d

Nebraska State AG+20d

New Hampshire State AG+20d

Indiana State AG+20d

Maine State AG+22d

Massachusetts State AG+23d

Maryland State AG+316d · this page

Pattern: first filing Jan 1 (IL), last Nov 13 (MD) — a 316-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.maryland.gov/resources-info/SBN%20Documents/2025/ITU-376217.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 13, 2025
Raw hash: 3b9bd601dad57c82178146e62342a846e09d8bbec7d0db33950c6a891b8efb7b

Linked disclosures

Regulatory filings (8) · sorted by filing gap

Reporting entityConstangy, Brooks, Smith & Prophete, LLP

Victim entityUNIVERSAL LENDERS, LLC

Incidentdiscovered Nov 7, 2024

Stated responseInitiated an investigation of the matter with the help of independent cybersecurity experts

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.maryland.gov