HackingCustomer Data InvolvedIdentity (basic)Government IDHighResolved

STI Holdings, Inc.

bd_30d2e0b29b5e18b2 · schema v1 · pii pii-v1

Severity

High

Discovered

Sep 28, 2023

Filed

Dec 4, 2023

To disclose

10 weeks

Affected · nationwide

4,2941 in this filing

Linked

3 filings

Confidence

50%

Full breach record for STI Holdings, Inc. →

STI Holdings, Inc. experienced a data breach affecting one Maine resident. The breach, which was an external system breach (hacking), occurred between May 25, 2023, and June 9, 2023, and was discovered on September 28, 2023. The compromised information includes names and Social Security numbers. The company began notifying affected individuals on December 2, 2023, and offered 12 months of credit monitoring services.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Sep 28, 2023 → Filed with AG Dec 4, 202367d ⏱ ME AG >30d10 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 126 days

discovery → filing · 10 weeks / 67 days

May 25, 2023

Begins

Sep 28, 2023

Discovered

Dec 4, 2023

Filed

This filing is one of 3 about the same incident.View merged incident

A leak claim by arvinclub about this victim predates this filing by 103 days.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Sitearvinclubbd_1a472194226a1ff22023-08-23 · +103dVerified by operator

Regulatory filings (1) · sorted by filing gap

Massachusetts State AGbd_b0c4ee148688118a2023-12-04Verified by operator

Name: STI Holdings, Inc.
norm: sti holdings

Name: STI Holdings, Inc.
norm: sti holdings

Discovered: Sep 28, 2023
Breach occurred: May 25, 2023 – Jun 9, 2023
Undetected for: 126 daysoccurrence → discovery
Materiality determined: —
Notification sent: Dec 2, 2023
Affected individuals: 4,294state + nationwide
Data types: Identity (basic)Government ID
Data elements: Social Security number
Attack vector: Unauthorized Access
Threat actor: External

Changes made: 12 Months of credit monitoring provided by Cyberscout through Identity Force, a TransUnion company specializing in fraud assistance and remediation services
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 10 weeks(67 days from discovery to filing)
Compliance flags: ME AG >30d · 67dME resident >60d · 65dLeak >90d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Sep 28, 2023
→ Filed with AG: Dec 4, 2023
67d 30 days (soft) ME AG >30d
Maine
Discovered: Sep 28, 2023
→ Notified: Dec 2, 2023
65d 60 days (analyst band; statutory cap is 30 days) ME resident >60d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Sep 28, 2023 → Filed with AG: Dec 4, 2023	67d	30 days (soft)	ME AG >30d
Maine	Discovered: Sep 28, 2023 → Notified: Dec 2, 2023	65d	60 days (analyst band; statutory cap is 30 days)	ME resident >60d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Massachusetts State AGDec 4 · first

Maine State AGDec 4 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/9add8e5d-e67b-4f44-b770-71350dc6249b.shtml
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 4, 2023
Raw hash: 6c51548bf0a3a6bcf842a75e364dbcfe7512a7233d3de236990e9c0e49b3ddf7

Linked disclosures

Ransomware claims (1)

Regulatory filings (1) · sorted by filing gap

Reporting entitySTI Holdings, Inc.

Victim entitySTI Holdings, Inc.

Incidentdiscovered Sep 28, 2023

Stated response12 Months of credit monitoring provided by Cyberscout through Identity Force, a TransUnion company specializing in fraud assistance and remediation services

ComplianceME AG >30d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov