HackingStolen CredentialsCustomer Data InvolvedIdentity (basic)Government IDFinancial accountMediumContained

HMC Partner

bd_356d532e0f2c9729 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Aug 13, 2024

Filed

Nov 13, 2025

To disclose

—

Affected

1state residents only

Confidence

66%

Full breach record for HMC Partner →

HMC Partners notified the Maryland Attorney General of an email event affecting one Maryland resident. An unknown actor accessed an employee's email account on August 13, 2024. The compromised data included name, Social Security number, and financial account information. HMC secured the account, notified federal law enforcement, and is offering 12 months of identity monitoring. Written notice was sent to the affected resident on January 21, 2025.

J jump to incidentP pin to compareR raw source

Incident timeline

Aug 13, 2024

Begins

Aug 13, 2024

Discovered

Nov 13, 2025

Filed

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed1 affectedView incident

Name: HMC Partners
norm: hmc partners

Name: HMC Partner
norm: hmc partner
Domain: hmcpartner.com

Discovered: Aug 13, 2024
Breach occurred: Aug 13, 2024
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jan 21, 2025
Affected individuals: 1state-resident count only
Data types: Identity (basic)Government IDFinancial account
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1114 Email Collection
Threat actor: External
Regulator citations: Providing written notice of the Event to relevant state regulators
Initial access: valid_credentials

During the incident: Took steps to secure the email account
Assessed the security of HMC’s email environment
Investigated the account to determine what happened
Notified federal law enforcement
Offering access to identity monitoring services for twelve (12) months at no cost
Changes made: Reviewing and enhancing its existing policies and procedures
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.maryland.gov/resources-info/SBN%20Documents/2025/ITU-376219.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 13, 2025
Raw hash: 3ebaaacbb2301419999ef60ee9c9f909137c0eee9de30fb54ef7bb5c1c7a23cc

Reporting entityHMC Partners

Victim entityHMC Partner

Incidentdiscovered Aug 13, 2024

Stated responseTook steps to secure the email account

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.maryland.gov