DisclosureLens
HackingProfessional ServicesHacking OtherCustomer Data InvolvedFinancial accountFinancial credentialsLow

Dirigo Management Company

bd_3835e491c36aadad · schema v1 · pii pii-v1

Severity

Low

Discovered

Aug 24, 2022

Filed

Oct 13, 2022

To disclose

7 weeks

Affected · nationwide

635564 in this filing

Linked

5 filings

Confidence

75%
Full breach record for Dirigo Management Company →

Dirigo Management Company, a commercial entity, experienced an external system breach (hacking) that occurred between May 10, 2022, and July 18, 2022. The breach was discovered on August 24, 2022. The incident affected 564 Maine residents, compromising their names or other personal identifiers in combination with financial account numbers or credit/debit card numbers (along with security codes, access codes, passwords, or PINs). In response, the company provided written notification to the affected individuals on September 23, 2022, and offered 12 months of credit monitoring, identity theft detection and restoration, and identity theft insurance services through Experian.

Maine clockDiscovered Aug 24, 2022 → Filed with AG Oct 13, 202250d ⏱ ME AG >30d7 weeks discovery → filing
⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 106 days
discovery → filing · 7 weeks / 50 days

May 10, 2022

Begins

Aug 24, 2022

Discovered

Oct 13, 2022

Filed

This filing is one of 5 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Filing propagation · 5 filings · 4 states

View merged incident ↗
Maine State AGSep 23 · first
Indiana State AGSep 23 · first
Maine State AG+20d · this page

Pattern: first filing Sep 23 (ME), last Oct 13 (ME) — a 20-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.