HackingData ExfiltratedCustomer Data InvolvedDelayed DiscoveryPIIIDENTITY_GOVERNMENTFINANCIAL_ACCOUNTMediumContained
WaterStreet Company
bd_46e579e8a85f1045 · schema v1 · pii pii-v1
Full breach record for WaterStreet Company →On March 17, 2025, WaterStreet Company (Kalispell, MT) discovered suspicious activity indicating an unauthorized actor accessed certain files containing personal information including names, Social Security numbers, and bank account information. The incident affected 25,115 individuals total, including 4 Maine residents. Written notification was sent May 7, 2025. WaterStreet notified federal law enforcement and is offering 12 months of credit monitoring through IDX.
Maine clockDiscovered Mar 17, 2025 → Filed with AG May 7, 202551d ⏱ ME AG >30d7 weeks discovery → filing
⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
This filing is one of 4 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (3) · sorted by filing gap
- bd_9d8762d44215a62dVermont State AGfiled 2025-05-07Verified
- bd_d7b77925736857c7New Hampshire State AGfiled 2025-05-07Verified
- bd_d25bdafd457e3641Indiana State AGfiled 2025-05-17(10d gap)Verified
Source provenance
- Source URL
- https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/25103dc9-ce30-48a0-937c-ab58b98dde85.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- May 7, 2025
- Raw hash
- de394cdf4aba684b639c92921b29203a1b083dfcc51d8b00e6e601353df67d42
Reporting entity
- Name
- WaterStreet Companynorm: waterstreet
- Domain
- waterstreetcompany.com
- Industry
- Other Commercial
Victim entity
- Name
- WaterStreet Companynorm: waterstreet
- Domain
- waterstreetcompany.com
- Industry
- Other Commercial
Incident
- Discovered
- Mar 17, 2025
- Materiality determined
- —
- Notification sent
- May 7, 2025
- Affected individuals
- 4
- Data types
- PIIIDENTITY_GOVERNMENTFINANCIAL_ACCOUNT
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1078 Valid Accounts
- Threat actor
- External
- Regulator citations
- Federal law enforcement notified
Compliance
- Time to disclose
- 7 weeks(51 days from discovery to filing)
- Compliance flags
- ME AG >30d · 51d
- Discovery-date grounding
- occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
- Clock breakdown
Statute Window Elapsed Threshold Status Maine Discovered: Mar 17, 2025→ Filed with AG: May 7, 202551d 30 days (soft) ME AG >30d
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.