HackingFinancial ServicesFinanceStolen CredentialsCustomer Data InvolvedTargetedIdentity (basic)Government IDFinancial accountMediumContained

Vantage Financial Group

bd_39b0eeaa241acec6 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Dec 5, 2024

Filed

Feb 5, 2025

To disclose

9 weeks

Affected

1state residents only

Linked

4 filings

Confidence

66%

Full breach record for Vantage Financial Group →2 incidents on file

Vantage Financial Group, Toledo reported an external system breach (hacking) where an employee's email account was accessed by an unknown actor between August 28 and September 5, 2024. The incident affected 1 Maine resident, exposing names, SSNs, driver's license numbers, and financial account information. Vantage secured the account, notified law enforcement, and offered 12 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Dec 5, 2024 → Filed with AG Feb 5, 202562d ⏱ ME AG >30d9 weeks discovery → filing

Incident timeline

undetected · 99 days

discovery → filing · 9 weeks / 62 days

Aug 28, 2024

Begins

Dec 5, 2024

Discovered

Feb 5, 2025

Filed

vs. sector median

+1 wks slower

This filing is one of 4 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Indiana State AGbd_81a38340e6110f432025-02-05Verified
Massachusetts State AGbd_90e5b3d069d3974d2025-02-05Verified
Montana State AGbd_6aff32ddffdc4c5d2025-01-05 · +31dCandidate

Name: Vantage Financial Group
norm: vantage financial
Domain: vanfin.com
Industry: Financial Services

Name: Vantage Financial Group
norm: vantage financial
Domain: vanfin.com
Industry: Financial Services
Industry: Financial Servicesllm

Discovered: Dec 5, 2024
Breach occurred: Aug 28, 2024 – Sep 5, 2024
Undetected for: 99 daysoccurrence → discovery
Materiality determined: —
Notification sent: Feb 5, 2025
Affected individuals: 1state-resident count only
Data types: Identity (basic)Government IDFinancial account
Data elements: Social Security number
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1114 Email Collection
Threat actor: External
Regulator citations: Notified relevant state regulatorsNotified the three major credit reporting agencies (Equifax, Experian, TransUnion)
Initial access: valid_credentials

During the incident: Secured the email account
Validated the security of Vantage’s email environment
Investigated the account to determine what happened
Notified federal law enforcement
Offered 12 months of complimentary credit monitoring services through Experian
Changes made: Reviewing and enhancing existing policies and procedures
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 9 weeks(62 days from discovery to filing)
Compliance flags: ME AG >30d · 62d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Dec 5, 2024
→ Filed with AG: Feb 5, 2025
62d 30 days (soft) ME AG >30d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Dec 5, 2024 → Filed with AG: Feb 5, 2025	62d	30 days (soft)	ME AG >30d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Montana State AGJan 5 · first

Indiana State AG+31d

Massachusetts State AG+31d

Maine State AG+31d · this page

Pattern: first filing Jan 5 (MT), last Feb 5 (ME) — a 31-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/42699840-8428-4bad-91c5-4518ff4ee767.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 5, 2025
Raw hash: 04ea5d66f5a7e273483062147ae3763ac60fbbd41c97323975e49546d7e59f41

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityVantage Financial Group

Victim entityVantage Financial Group

Incidentdiscovered Dec 5, 2024

Stated responseSecured the email account

ComplianceME AG >30d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov