Social EngineeringTechnologyProfessional ServicesInformationPhishingTargetedIdentity (basic)Government IDEmploymentMediumContained

Colaberry, Inc.

bd_3f32ab8db6cf9bdd · schema v1 · pii pii-v1

Severity

Medium

Discovered

Feb 6, 2026

Filed

Mar 24, 2026

To disclose

7 weeks

Affected

1state residents only

Linked

3 filings

Confidence

66%

Full breach record for Colaberry, Inc. →

Colaberry, Inc. reported a data breach to the Maine Attorney General on March 24, 2026. On February 5, 2026, employee W-2 data (including names, SSNs, and employment info) was inadvertently sent to an unauthorized actor via a spoofed phishing email. The breach was discovered on February 6, 2026. One Maine resident was affected. Colaberry notified the IRS, offered 24 months of credit monitoring, and implemented additional employee safeguards.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Feb 6, 2026 → Filed with AG Mar 24, 202646d ⏱ ME AG >30d7 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 1 days

discovery → filing · 7 weeks / 46 days

Feb 5, 2026

Begins

Feb 6, 2026

Discovered

Mar 24, 2026

Filed

vs. sector median

12 wks faster

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Indiana State AGbd_1cf10b11d5ea94912026-03-24Candidate
Massachusetts State AGbd_d88c5140210eefdc2026-03-24Verified

Name: Colaberry, Inc.
norm: colaberry
Domain: colaberry.com

Name: Colaberry, Inc.
norm: colaberry
Domain: colaberry.com
Industry: TechnologyllmProfessional Servicesllm

Discovered: Feb 6, 2026
Breach occurred: Feb 5, 2026
Undetected for: 1 dayoccurrence → discovery
Materiality determined: —
Notification sent: Mar 24, 2026
Affected individuals: 1state-resident count only
Data types: Identity (basic)Government IDEmployment
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Notified the IRSProvided written notice to relevant state privacy regulatorsNotified the three (3) major credit reporting agencies: Equifax, Experian, and TransUnion
Initial access: phishing_link

During the incident: Launched an investigation into the nature and scope of the event
Notified the IRS of what happened
Providing access to complimentary credit monitoring and identity theft protection services for twenty-four (24) months through Cyberscout, a TransUnion company
Providing impacted individuals with guidance on how to better protect against identity theft and fraud
Providing written notice of this event to relevant state privacy regulators and to the three (3) major credit reporting agencies
Changes made: Undertaking a review to determine what information may be involved
Working to implement additional safeguards and training for its employees to protect against similar events in the future
Reviewing existing security policies and have reinforced with our staff the importance of safeguarding information in our possession
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 7 weeks(46 days from discovery to filing)
Compliance flags: ME AG >30d · 46d
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Feb 6, 2026
→ Filed with AG: Mar 24, 2026
46d 30 days (soft) ME AG >30d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Feb 6, 2026 → Filed with AG: Mar 24, 2026	46d	30 days (soft)	ME AG >30d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Indiana State AGMar 24 · first

Massachusetts State AGMar 24 · first

Maine State AGMar 24 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/1bc4a467-c794-4ecc-96da-c5e8e4949010.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 24, 2026
Raw hash: c52bb69a2f252192e3a3f4849d2744378b2f2b6adc66cdbb6926951d7ca02e5d

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityColaberry, Inc.

Victim entityColaberry, Inc.

Incidentdiscovered Feb 6, 2026

Stated responseLaunched an investigation into the nature and scope of the event

ComplianceME AG >30d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov