HackingProfessional ServicesProfessional ServicesTargetedIdentity (basic)Government IDHighContained

Corban OneSource, LLC

bd_28e8b0feb6148798 · schema v1 · pii pii-v1

Severity

High

Discovered

Sep 9, 2025

Filed

Feb 4, 2026

To disclose

21 weeks

Affected · nationwide

1,5932 in this filing

Linked

2 filings

Confidence

66%

Full breach record for Corban OneSource, LLC →2 incidents on file

Corban OneSource, LLC reported an external system breach (hacking) on September 9, 2025, affecting 1,593 individuals, including 2 Maine residents. The incident involved unauthorized access to files containing names and Social Security numbers. Corban secured the network, notified law enforcement, and sent notification letters on February 4, 2026, offering one year of credit monitoring via Epiq.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Sep 9, 2025 → Filed with AG Feb 4, 2026148d ✗ ME AG >90d21 weeks discovery → filing

⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Incident timeline

discovery → filing · 21 weeks / 148 days

Sep 9, 2025

Begins

Sep 9, 2025

Discovered

Feb 4, 2026

Filed

vs. sector median

+2 wks slower

This filing is one of 2 about the same incident.View merged incident

A leak claim by qilin about this victim predates this filing by 124 days.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Siteqilinbd_04d1ab9350ae5a6b2025-10-03 · +124dVerified

Name: BAKER & HOSTETLER LLP
norm: baker hostetler

Name: Corban OneSource, LLC
norm: corban onesource
Domain: corbanone.com
Industry: Professional Servicesllm

Discovered: Sep 9, 2025
Breach occurred: Sep 9, 2025
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Feb 4, 2026
Affected individuals: 1,593state + nationwide
Data types: Identity (basic)Government ID
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: External
Regulator citations: Notified law enforcement
Initial access: exploit_public_facing

During the incident: Took steps to secure the network
Launched an investigation into the matter
Notified law enforcement of the incident and are supporting its investigation
Sent a notification letter via U.S. First-Class mail to the Maine residents
Offering the notified individual a complimentary one-year subscription in credit monitoring and identity theft protection services through Epiq
Established a dedicated, toll-free call center for individuals to call with questions
Changes made: Taken additional steps to enhance their security measures
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 21 weeks(148 days from discovery to filing)
Compliance flags: ME AG >90d · 148dME resident >60d · 148dLeak >90d
Discovery-date grounding: occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Sep 9, 2025
→ Filed with AG: Feb 4, 2026
148d 90 days ME AG >90d
Maine
Discovered: Sep 9, 2025
→ Notified: Feb 4, 2026
148d 60 days (analyst band; statutory cap is 30 days) ME resident >60d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Sep 9, 2025 → Filed with AG: Feb 4, 2026	148d	90 days	ME AG >90d
Maine	Discovered: Sep 9, 2025 → Notified: Feb 4, 2026	148d	60 days (analyst band; statutory cap is 30 days)	ME resident >60d

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/c0502bd2-4671-473f-bf6c-8064ff699ff3.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 4, 2026
Raw hash: f1d253a8dadb98e480c3b31fc23858a821ca69aa8b550727bcad2e9de59f866a

Linked disclosures

Ransomware claims (1)

Reporting entityBAKER & HOSTETLER LLP

Victim entityCorban OneSource, LLC

Incidentdiscovered Sep 9, 2025

Stated responseTook steps to secure the network

ComplianceME AG >90d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov