HackingOtherData ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDFinancial accountPHIHealth (basic)HighContained

Westwood Country Club

bd_2cb79ecfdcef8c8d · schema v1 · pii pii-v1

Severity

High

Discovered

Mar 14, 2025

Filed

Mar 24, 2025

To disclose

10 days

Affected · nationwide

3,2031 in this filing

Linked

6 records

Confidence

66%

Full breach record for Westwood Country Club →

Westwood Country Club experienced an external system breach (hacking) on October 17, 2024. The incident was discovered on March 14, 2025, after an investigation determined unauthorized actors accessed and copied files. Approximately 3,203 individuals were affected, including 1 Maine resident. Compromised data included names, SSNs, driver's license numbers, financial account info, and health/medical information. The club engaged a cybersecurity firm, secured its network, and provided 24 months of credit monitoring and identity protection services to affected individuals.

J jump to incidentP pin to compareR raw source

Leak gap clock⏱ Leak >90d10 days discovery → filing

Incident timeline

undetected · 148 days

discovery → filing · 10 days

Oct 17, 2024

Begins

Mar 14, 2025

Discovered

Mar 24, 2025

Filed

vs. sector median

4 wks faster

This filing is one of 6 records about the same incident.View merged incident

A leak claim by meow about this victim was first seen 149 days before this filing.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Sitemeowbd_9f8585e0377ee29b2024-10-26 · +148dVerified by operator

Regulatory filings (4) · sorted by filing gap

Indiana State AGbd_0a073f689cb76fb42025-03-24Candidate
Massachusetts State AGbd_8c54bfd0c2b6b8e62025-03-24Verified
Nebraska State AGbd_96ced4adf436fed12025-03-24Verified
Maryland State AGbd_81c9fde4306f09902026-04-23 · +395dVerified

Name: Westwood Country Club
norm: westwood country club
Domain: westwoodcc.com

Name: Westwood Country Club
norm: westwood country club
Domain: westwoodcc.com
Industry: Otherllm

Discovered: Mar 14, 2025
Breach occurred: Oct 17, 2024
Undetected for: 148 daysoccurrence → discovery
Materiality determined: —
Notification sent: Mar 24, 2025
Affected individuals: 3,203state + nationwide
Data types: Identity (basic)Government IDFinancial accountPHIHealth (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 ChannelT1119 Automated Collection
Threat actor: ExternalFinancial
Regulator citations: Filed notification with Maine Attorney General
Initial access: exploit_public_facing

During the incident: Engaged a specialized cybersecurity firm to investigate the nature and scope of the incident
Took steps to secure its network
Providing access to Single Bureau Credit Monitoring/Single Bureau Credit Report/Single Bureau Credit Score services at no charge
Providing proactive fraud assistance
Changes made: Providing 24 months complimentary credit monitoring and identity protection services
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 10 days(10 days from discovery to filing)
Compliance flags: Leak >90dME AG ≤30d · 10d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Mar 14, 2025
→ Filed with AG: Mar 24, 2025
10d 30 days ME AG ≤30d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Mar 14, 2025 → Filed with AG: Mar 24, 2025	10d	30 days	ME AG ≤30d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Indiana State AGMar 24 · first

Massachusetts State AGMar 24 · first

Nebraska State AGMar 24 · first

Maine State AGMar 24 · first · this page

Maryland State AG+395d

Pattern: first filing Mar 24 (IN), last Apr 23 (MD) — a 395-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/43d39c2e-48a7-4692-94ed-1a2d0d0d768f.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 24, 2025
Raw hash: e3e14376dcb8756de2b7fab5929a9ab1f76d9bf0022ac9add66e8ca49948ddfb

Linked disclosures

Ransomware claims (1)

Regulatory filings (4) · sorted by filing gap

Reporting entityWestwood Country Club

Victim entityWestwood Country Club

Incidentdiscovered Mar 14, 2025

Stated responseEngaged a specialized cybersecurity firm to investigate the nature and scope of the incident

ComplianceLeak >90d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov