HackingProfessional ServicesProfessional ServicesData ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDHighContained

Wold Architects & Engineers

bd_3408c55326556eda · schema v1 · pii pii-v1

Severity

High

Discovered

Apr 10, 2024

Filed

Jun 28, 2024

To disclose

11 weeks

Affected · nationwide

2,1052 in this filing

Linked

5 records

Confidence

66%

Full breach record for Wold Architects & Engineers →

Wold Architects and Engineers experienced an external system breach (hacking) between April 7 and April 10, 2024. The incident affected 2,105 individuals, including 2 Maine residents. Personal information accessed included names, driver's license numbers, SSNs, and passport numbers. Wold engaged cybersecurity specialists, secured the network, and notified affected individuals on June 28, 2024, offering 12 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Apr 10, 2024 → Filed with AG Jun 28, 202479d ⏱ ME AG >30d11 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 3 days

discovery → filing · 11 weeks / 79 days

Apr 7, 2024

Begins

Apr 10, 2024

Discovered

Jun 28, 2024

Filed

vs. sector median

8 wks faster

This filing is one of 5 records about the same incident.View merged incident

A leak claim by abyss about this victim was first seen 52 days before this filing.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Siteabyssbd_804077b7a13991962024-05-07 · +51dCandidate

Regulatory filings (3) · sorted by filing gap

Massachusetts State AGbd_990d0306d7dad8782024-06-28Verified
Vermont State AGbd_ab27b95ae412b5f22024-06-28Verified
Montana State AGbd_fb021add1dbdcb982024-06-28Verified

Name: Constangy, Brooks, Smith & Prophete, LLP
norm: constangy brooks smith prophete

Name: Wold Architects & Engineers
norm: wold architects engineers
Domain: woldae.com
Industry: Professional Servicesllm

Discovered: Apr 10, 2024
Breach occurred: Apr 7, 2024 – Apr 10, 2024
Undetected for: 3 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jun 28, 2024
Affected individuals: 2,105state + nationwide
Data types: Identity (basic)Government ID
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Notified Office of the Maine Attorney GeneralProvided written notice to the three major credit reporting agencies, Equifax, Experian, and TransUnion
Initial access: exploit_public_facing

During the incident: Took steps to secure the network
Launched an investigation aided by cybersecurity specialists
Conducted a comprehensive review of files to identify personal information
Provided access to credit monitoring services for twelve months through IDX
Provided impacted individuals with guidance on how to better protect against identity theft and fraud
Provided written notice to relevant state regulators
Provided written notice to the three major credit reporting agencies
Changes made: Implementing additional safeguards and training to employees
Implemented additional security measures to help reduce the risk of a similar incident occurring in the future
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 11 weeks(79 days from discovery to filing)
Compliance flags: ME AG >30d · 79dLeak >30d
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Apr 10, 2024
→ Filed with AG: Jun 28, 2024
79d 30 days (soft) ME AG >30d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Apr 10, 2024 → Filed with AG: Jun 28, 2024	79d	30 days (soft)	ME AG >30d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Massachusetts State AGJun 28 · first

Vermont State AGJun 28 · first

Montana State AGJun 28 · first

Maine State AGJun 28 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/7b3c7ce1-59a0-4933-80d8-380421a7d2ee.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 28, 2024
Raw hash: 474f717386653b1b29f8ecfe77dea8c2e3565db5467732558895b7130e0e9399

Linked disclosures

Ransomware claims (1)

Regulatory filings (3) · sorted by filing gap

Reporting entityConstangy, Brooks, Smith & Prophete, LLP

Victim entityWold Architects & Engineers

Incidentdiscovered Apr 10, 2024

Stated responseTook steps to secure the network

ComplianceME AG >30d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov