HackingSupply Chain (3P Vendor)Customer Data InvolvedIDENTITY_BASICIDENTITY_GOVERNMENTMediumContained
AILCO
bd_3ec35e151f8c57bb · schema v1 · pii pii-v1
Full breach record for AILCO →Ailco Equipment Finance Group, Inc. notified consumers that its third-party service provider, Kaaj Technologies Inc., experienced unauthorized access to its credit analysis platform on January 13, 2026. Ailco learned of the incident on February 11, 2026. The incident may have exposed applicant names, addresses, and Social Security numbers. Ailco engaged forensic specialists and is offering credit monitoring services.
Vermont clock⏱ VT AG >14 bday6 weeks discovery → filing
⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
This filing is one of 3 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (2) · sorted by filing gap
- bd_6c5086c2a4ac0cd7New Hampshire State AGfiled 2026-03-26Verified
- bd_9bf329650e4d359dIndiana State AGfiled 2026-03-26Candidate
Source provenance
- Source URL
- https://ago.vermont.gov/document/2026-03-26-ailco-data-breach-notice-consumers
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Mar 26, 2026
- Raw hash
- 46fb95189d35bf2e0322c0dd35d9680749b3787d93352911821c4c0a7b68ef0b
Reporting entity
- Name
- AILCOnorm: ailco
- Domain
- ailco.com
Victim entity
- Name
- AILCOnorm: ailco
- Domain
- ailco.com
Incident
- Discovered
- Feb 11, 2026
- Materiality determined
- —
- Notification sent
- Mar 26, 2026
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENT
- Attack vector
- Third-Party / Supply Chain
- MITRE ATT&CK
- T1195 Supply Chain CompromiseT1119 Automated Collection
- Threat actor
- External
- Third party
- via Kaaj Technologies Inc.
- Initial access
- supply_chain
Compliance
- Time to disclose
- 6 weeks(43 days from discovery to filing)
- Compliance flags
- VT AG >14 bday
- Discovery-date grounding
- unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.