HackingData ExfiltratedRansom DemandedPIIMediumContained
Hurtigruten Pluss AS
bd_28e44775fb20d264 · schema v1 · pii pii-v1
Full breach record for Hurtigruten Pluss AS →Hurtigruten Pluss AS, a hospitality entity based in Norway, reported a cybersecurity incident to the Maine Attorney General. The breach occurred on December 14, 2020, involving an external system breach (hacking). The incident affected an estimated 4,017 individuals, including 18 Maine residents. Notification was sent on March 1, 2021. The filing notes a ransomware attacker copied information, though the specific ransomware family is not named in this summary.
Maine clockDiscovered Dec 14, 2020 → Filed with AG Mar 3, 202179d ⏱ ME AG >30d11 weeks discovery → filing
⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed4,017 affectedView incident
Source provenance
- Source URL
- https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/04ba0bf2-aa5a-46ea-bc54-ddb808297de5.shtml
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Mar 3, 2021
- Raw hash
- d4b617b6cacc26c37ab4442d7a74ef132946a9642b5824752aa79fea228dd66d
Reporting entity
- Name
- Foster Garvey PCnorm: foster garvey
Victim entity
- Name
- Hurtigruten Pluss ASnorm: hurtigruten pluss
Incident
- Discovered
- Dec 14, 2020
- Materiality determined
- —
- Notification sent
- Mar 1, 2021
- Affected individuals
- 4,017
- Data types
- PII
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1190 Exploit Public-Facing Application
- Threat actor
- ExternalFinancial
- Regulator citations
- Filed data breach notice with Maine Attorney General
- Initial access
- exploit_public_facing
Compliance
- Time to disclose
- 11 weeks(79 days from discovery to filing)
- Compliance flags
- ME AG >30d · 79dME resident >60d · 77d
- Discovery-date grounding
- occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
- Clock breakdown
Statute Window Elapsed Threshold Status Maine Discovered: Dec 14, 2020→ Filed with AG: Mar 3, 202179d 30 days (soft) ME AG >30d Maine Discovered: Dec 14, 2020→ Notified: Mar 1, 202177d 60 days (analyst band; statutory cap is 30 days) ME resident >60d
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.