HackingData ExfiltratedCustomer Data InvolvedIDENTITY_GOVERNMENTIDENTITY_BASICHighContained
Form I-9 Compliance
bd_401ba42cacddd148 · schema v1 · pii pii-v1
Full breach record for Form I-9 Compliance →Form I-9 Compliance, a professional services firm based in Newport Beach, California, reported an external system breach (hacking) occurring between February 5, 2024, and April 12, 2024. The incident compromised the names and Social Security Numbers of 27,592 individuals, including 16 Maine residents. The company notified affected individuals in writing on May 31, 2024, and provided 24 months of identity theft protection and credit monitoring through Experian.
Maine clockDiscovered Apr 12, 2024 → Filed with AG May 31, 202449d ⏱ ME AG >30d7 weeks discovery → filing
⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.
This filing is one of 3 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (2) · sorted by filing gap
- bd_8f688b221999a8afCalifornia State AGfiled 2024-05-31Candidate
- bd_d920f5f5481dc1cdIndiana State AGfiled 2024-05-31Verified
Source provenance
- Source URL
- https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/c0ea4ec7-a813-433b-b966-e1201d2b92ca.shtml
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- May 31, 2024
- Raw hash
- 1603105eb2c39033c790fdd0cc55ec6e6e66ad7e3d6d3029f9e259bb1234a67e
Reporting entity
- Name
- Form I-9 Compliancenorm: form i 9 compliance
Victim entity
- Name
- Form I-9 Compliancenorm: form i 9 compliance
Incident
- Discovered
- Apr 12, 2024
- Materiality determined
- —
- Notification sent
- May 31, 2024
- Affected individuals
- 27,592
- Data types
- IDENTITY_GOVERNMENTIDENTITY_BASIC
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1190 Exploit Public-Facing Application
- Threat actor
- External
- Initial access
- exploit_public_facing
Compliance
- Time to disclose
- 7 weeks(49 days from discovery to filing)
- Compliance flags
- ME AG >30d · 49d
- Discovery-date grounding
- AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.
- Clock breakdown
Statute Window Elapsed Threshold Status Maine Discovered: Apr 12, 2024→ Filed with AG: May 31, 202449d 30 days (soft) ME AG >30d
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.