HackingInformationVulnerability ExploitSupply Chain (3P Vendor)Delayed DiscoveryCustomer Data InvolvedPIIGovernment IDHighContained

OpenClose, a

bd_2ccac4cd5f7e015e · schema v1 · pii pii-v1

Severity

High

Discovered

Sep 22, 2021

Filed

Oct 15, 2021

To disclose

23 days

Affected · nationwide

1,3131 in this filing

Linked

4 filings

Confidence

65%

Full breach record for OpenClose, a →

A third-party provider for OpenClose, a DBA of Beanstalk Networks, LLC, experienced a security breach due to a server vulnerability. The incident occurred on June 4, 2021, and was discovered on September 22, 2021. The breach resulted in the compromise of personal information, including names and Social Security numbers. Affected individuals were notified on October 15, 2021, and offered 12 months of complimentary credit monitoring services.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Sep 22, 2021 → Filed with AG Oct 15, 202123d ✓ ME AG ≤30d23 days discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 110 days

discovery → filing · 23 days

Jun 4, 2021

Begins

Sep 22, 2021

Discovered

Oct 15, 2021

Filed

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Massachusetts State AGbd_2df5d7dd431398f92021-10-15Verified
Indiana State AGbd_5f91dcf2e3f8edd32021-10-15Verified
New Hampshire State AGbd_cd2bc2a77add973d2021-10-18 · +3dVerified

Name: OpenClose, a
norm: openclose a

Name: OpenClose, a
norm: openclose a
Also named: OpenClose, adba oflegal entity
of Beanstalk Networks, LLCdba oftrade name

Discovered: Sep 22, 2021
Breach occurred: Jun 4, 2021
Undetected for: 110 daysoccurrence → discovery
Materiality determined: —
Notification sent: Oct 15, 2021
Affected individuals: 1,313state + nationwide
Data types: PIIGovernment ID
Data elements: Social Security number
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: External
Initial access: exploit_public_facing

During the incident: Offered 12 months of complimentary credit monitoring through Transunion
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 23 days(23 days from discovery to filing)
Compliance flags: ME AG ≤30d · 23d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Sep 22, 2021
→ Filed with AG: Oct 15, 2021
23d 30 days ME AG ≤30d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Sep 22, 2021 → Filed with AG: Oct 15, 2021	23d	30 days	ME AG ≤30d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Massachusetts State AGOct 15 · first

Indiana State AGOct 15 · first

Maine State AGOct 15 · first · this page

New Hampshire State AG+3d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/e43fbfc9-f846-4ca1-b283-d85ba2afa808.shtml
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 15, 2021
Raw hash: 96e37fbada11b47ffceadc2f3af8c6237e9af43f929ca05d1f464e2333bf3e35

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityOpenClose, a

Victim entityOpenClose, a

Incidentdiscovered Sep 22, 2021

Stated responseOffered 12 months of complimentary credit monitoring through Transunion

ComplianceME AG ≤30d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov