HackingStolen CredentialsCustomer Data InvolvedIdentity (basic)Government IDMediumContained

SSA Holdings, LLC

bd_349a8da9dbebf9c0 · schema v1 · pii pii-v1

Severity

Medium

Discovered

—

Filed

Nov 13, 2025

To disclose

—

Affected

3state residents only

Linked

8 filings

Confidence

65%

Full breach record for SSA Holdings, LLC →

CorrectionPublished Oct 10, 2026

The Montana Department of Justice register lists this notice on 2025-01-13, before the breach it reports. The Indiana, New Hampshire, California and Nebraska registers list the same notice on 2025-11-13, so we publish 2025-11-13 as the date it was filed.

Read their full statement

SSA Holdings, LLC reported that an unauthorized person gained access to its systems on September 15, 2025, acquiring files containing names and Social Security numbers. The company engaged Kroll for identity monitoring services and reported the incident to law enforcement.

J jump to incidentP pin to compareR raw source

Incident timeline

Sep 15, 2025

Begins

Nov 13, 2025

Filed

This filing is one of 8 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (7) · sorted by filing gap

Nebraska State AGbd_1dd069a5a2bc97412025-11-13Verified
Indiana State AGbd_6fc5dec703fe85f12025-11-13Verified
Massachusetts State AGbd_9ace5e7496f9a3f22025-11-13Verified
California State AGbd_ab4cf346f9f94b092025-11-13Verified

Show 3 more filings ↓up to 12d gap

New Hampshire State AGbd_c34bbad8fe4d69b22025-11-13Verified
Texas State AGbd_0efcbd22983e9c592025-11-14 · +1dCandidate
Illinois State AGbd_54fa92149d4d3aed2025-11-01 · +12dVerified

Name: SSA Holdings, LLC
norm: ssa holdings

Name: SSA Holdings, LLC
norm: ssa holdings

Discovered: —
Breach occurred: Sep 15, 2025
Materiality determined: —
Notification sent: —
Affected individuals: 3state-resident count only
Data types: Identity (basic)Government ID
Data elements: Social Security number
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: ExternalFinancial
Initial access: valid_credentials

During the incident: Took action to contain the incident
Began an investigation
Reported the incident to law enforcement
Secured the services of Kroll to provide identity monitoring
Changes made: Enhance the security of our computer network
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 8 filings · 8 states

View merged incident ↗

Illinois State AGNov 1 · first

Nebraska State AG+12d

Indiana State AG+12d

Massachusetts State AG+12d

California State AG+12d

New Hampshire State AG+12d

Montana State AG+12d · this page

Texas State AG+13d

Pattern: first filing Nov 1 (IL), last Nov 14 (TX) — a 13-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/2025/11/Consumer-notification-letter-35.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 13, 2025
Raw hash: d4c6f605acd4e66e0fe15b7c9e31095b8b5bed6ffcfefc1b6f07143fd3f4bdd8

Linked disclosures

Regulatory filings (7) · sorted by filing gap

Reporting entitySSA Holdings, LLC

Victim entitySSA Holdings, LLC

IncidentUnauthorized Access

Stated responseTook action to contain the incident

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov