HackingEnergy & UtilitiesUtilitiesData ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDHighContained

Posillico, Inc.

bd_44a73f68a4b036f8 · schema v1 · pii pii-v1

Severity

High

Discovered

Dec 8, 2025

Filed

Jan 13, 2026

To disclose

5 weeks

Affected · nationwide

9,8763 in this filing

Linked

6 filings

Confidence

65%

Full breach record for Posillico, Inc. →

Posillico, Inc. reported an external system breach (hacking) on December 8, 2025, affecting 9,876 individuals, including 3 Maine residents. The incident involved unauthorized access to files containing names and Social Security numbers. Posillico engaged cybersecurity experts, secured its network, notified the FBI IC3, and provided 12 months of complimentary identity monitoring through IDX to affected individuals. Notices were sent on January 13, 2026.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Dec 8, 2025 → Filed with AG Jan 13, 202636d ⏱ ME AG >30d5 weeks discovery → filing

Incident timeline

discovery → filing · 5 weeks / 36 days

Dec 8, 2025

Begins

Dec 8, 2025

Discovered

Jan 13, 2026

Filed

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Siteakirabd_6e40b4482a58436d2026-01-05 · +8dVerified by operator

Regulatory filings (4) · sorted by filing gap

Indiana State AGbd_5a3657aff91914952026-01-13Verified
New Hampshire State AGbd_3113f98872d9866d2026-01-14 · +1dVerified
Texas State AGbd_38c7da76d6bafa632026-01-14 · +1dVerified
Massachusetts State AGbd_4c615aeffe9db2052026-01-14 · +1dVerified by operator

Name: Constangy, Brooks, Smith & Prophete, LLP
norm: constangy brooks smith prophete

Name: Posillico, Inc.
norm: posillico
Domain: posillico.com
Industry: Energy & Utilitiesllm

Discovered: Dec 8, 2025
Breach occurred: Dec 8, 2025
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jan 13, 2026
Affected individuals: 9,876state + nationwide
Data types: Identity (basic)Government ID
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1119 Automated Collection
Threat actor: External
Regulator citations: Reported this incident to the FBI’s Internet Crime Complaint Center
Initial access: exploit_public_facing

During the incident: Engaged independent cybersecurity experts to assist with the process
Undertook a comprehensive review of those files to confirm the specific information involved
Took steps to secure its network environment
Launched an investigation to determine what happened and the scope of personal information potentially impacted
Reported this incident to the FBI’s Internet Crime Complaint Center
Provided notified individuals with information about steps they can take to protect their personal information
Offered them access to complimentary identity monitoring services
Established a toll-free call center through IDX
Changes made: Implemented measures to enhance the security of its environment in an effort to minimize the risk of a similar incident occurring in the future
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 weeks(36 days from discovery to filing)
Compliance flags: ME AG >30d · 36d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Dec 8, 2025
→ Filed with AG: Jan 13, 2026
36d 30 days (soft) ME AG >30d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Dec 8, 2025 → Filed with AG: Jan 13, 2026	36d	30 days (soft)	ME AG >30d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Indiana State AGJan 13 · first

Maine State AGJan 13 · first · this page

New Hampshire State AG+1d

Texas State AG+1d

Massachusetts State AG+1d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/6c9cb417-f8f3-4e1e-9876-4484ed54f66d.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 13, 2026
Raw hash: e17e878d8c926cad884ecf0019b44cf4979a5408b51ed2134e1d5a8d7b98d1a1

Linked disclosures

Ransomware claims (1)

Regulatory filings (4) · sorted by filing gap

Reporting entityConstangy, Brooks, Smith & Prophete, LLP

Victim entityPosillico, Inc.

Incidentdiscovered Dec 8, 2025

Stated responseEngaged independent cybersecurity experts to assist with the process

ComplianceME AG >30d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov