HackingOtherCustomer Data InvolvedDelayed DiscoveryPIILowResolved
Service & Access Management, Inc.
bd_3f971209f2652a64 · schema v1 · pii pii-v1
Full breach record for Service & Access Management, Inc. →Service Access & Management, Inc. (SAM), a nonprofit human services organization in Pennsylvania and New Jersey, discovered suspicious activity on its network on July 5, 2024. An unauthorized user potentially accessed SAM's systems. By September 12, 2024, affected files were identified; a review completed January 31, 2025 confirmed some PII may have been exposed. Four Maine residents were affected. Notifications were sent February 27, 2025. IDX credit monitoring was offered.
Maine clockDiscovered Jul 5, 2024 → Filed with AG Feb 27, 2025237d ✗ ME AG >90d34 weeks discovery → filing
⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
This filing is one of 3 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (2) · sorted by filing gap
- bd_012d8fbee482211bMaryland State AGfiled 2025-02-27Verified
- bd_f92bde62a8816c56Vermont State AGfiled 2025-02-27Verified
Source provenance
- Source URL
- https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/917377f3-c5f6-4902-b91b-f7dd8b2fca13.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Feb 27, 2025
- Raw hash
- e954c73219792f60028df268f72c257f6406ef8f793ff6547ffca177ac4fce01
Reporting entity
- Name
- Service & Access Management, Inc.norm: service access management
- Industry
- Non-Profit Human Services
Victim entity
- Name
- Service & Access Management, Inc.norm: service access management
- Industry
- Non-Profit Human Services
- Industry
- Otherllm
Incident
- Discovered
- Jul 5, 2024
- Materiality determined
- Jan 31, 2025
- Notification sent
- Feb 27, 2025
- Affected individuals
- 4
- Data types
- PII
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1078 Valid Accounts
- Threat actor
- External
Compliance
- Time to disclose
- 34 weeks(237 days from discovery to filing)
- Compliance flags
- ME AG >90d · 237dME resident >180d · 237d
- Discovery-date grounding
- occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
- Clock breakdown
Statute Window Elapsed Threshold Status Maine Discovered: Jul 5, 2024→ Filed with AG: Feb 27, 2025237d 90 days ME AG >90d Maine Discovered: Jul 5, 2024→ Notified: Feb 27, 2025237d 180 days ME resident >180d
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.