HackingRetail & ConsumerRetailData ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDHighContained

Georgetown Brewing Company

bd_44441ed00e966a82 · schema v1 · pii pii-v1

Severity

High

Discovered

Aug 22, 2025

Filed

Sep 26, 2025

To disclose

5 weeks

Affected · nationwide

19,6963 in this filing

Linked

7 filings

Confidence

65%

Full breach record for Georgetown Brewing Company →2 incidents on file

Georgetown Brewing Company experienced an external system breach on August 22, 2025, resulting in the exfiltration of names and driver's license numbers from its servers. The incident affected 19,696 individuals nationwide, including 3 Maine residents. The company reported the incident to law enforcement, implemented additional safeguards, and offered 24 months of identity protection services to affected individuals.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Aug 22, 2025 → Filed with AG Sep 26, 202535d ⏱ ME AG >30d5 weeks discovery → filing

⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Incident timeline

discovery → filing · 5 weeks / 35 days

Aug 22, 2025

Begins

Aug 22, 2025

Discovered

Sep 26, 2025

Filed

vs. sector median

3 wks faster

This filing is one of 7 about the same incident.View merged incident

A leak claim by inc_ransom about this victim predates this filing by 35 days.View originating leak claim

Linked disclosures

Why this link?

Regulatory filings (6) · sorted by filing gap

Massachusetts State AGbd_1ef919bdc0a408392025-09-26Verified
Nebraska State AGbd_4401b669b64ed4c02025-09-26Verified
Indiana State AGbd_507654b336c26f6a2025-09-26Verified
Vermont State AGbd_c62af42c4d23d1a22025-09-26Verified

Show 2 more filings ↓

Montana State AGbd_ccef8b961699fbfe2025-09-26Candidate
Washington State AGbd_d1ceb3c9b2dd60da2025-09-26Verified

Name: Georgetown Brewing Company
norm: georgetown brewing
Domain: georgetownbeer.com

Name: Georgetown Brewing Company
norm: georgetown brewing
Domain: georgetownbeer.com
Industry: Retail & Consumerllm

Discovered: Aug 22, 2025
Breach occurred: Aug 22, 2025
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Sep 26, 2025
Affected individuals: 19,696state + nationwide
Data types: Identity (basic)Government ID
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Filed notice with Maine Attorney General
Initial access: exploit_public_facing

During the incident: Reported this incident to law enforcement
Offering identity theft protection services through IDX
Changes made: Taking steps to implement additional safeguards
Review policies and procedures relating to data privacy and security
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 weeks(35 days from discovery to filing)
Compliance flags: ME AG >30d · 35dLeak >30d
Discovery-date grounding: occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Aug 22, 2025
→ Filed with AG: Sep 26, 2025
35d 30 days (soft) ME AG >30d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Aug 22, 2025 → Filed with AG: Sep 26, 2025	35d	30 days (soft)	ME AG >30d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 7 filings · 7 states

View merged incident ↗

Massachusetts State AGSep 26 · first

Nebraska State AGSep 26 · first

Indiana State AGSep 26 · first

Vermont State AGSep 26 · first

Montana State AGSep 26 · first

Washington State AGSep 26 · first

Maine State AGSep 26 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/3c68cce3-312b-458b-9825-b2211b4b7230.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 26, 2025
Raw hash: b0be391ee27d60d309ff1b8a3402499e420c5ba7eee539b865127227e16a00f2

Linked disclosures

Regulatory filings (6) · sorted by filing gap

Reporting entityGeorgetown Brewing Company

Victim entityGeorgetown Brewing Company

Incidentdiscovered Aug 22, 2025

Stated responseReported this incident to law enforcement

ComplianceME AG >30d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov