HackingProfessional ServicesProfessional ServicesCapture Stored DataData ExfiltratedCustomer Data InvolvedDelayed DiscoveryPIIIDENTITY_BASICIDENTITY_GOVERNMENTMediumContained
A.C. Roman & Associates, Inc.
bd_48be7b4f7c706d21 · schema v1 · pii pii-v1
Full breach record for A.C. Roman & Associates, Inc. →On September 24, 2025, an unauthorized actor accessed A.C. Roman & Associates, Inc.'s network and exfiltrated a limited subset of data. Roman provides insurance claims adjudication services. The breach was discovered on December 4, 2025 after a comprehensive forensic review. Affected data included names, dates of birth, and Social Security numbers. One Maine resident was affected. Notifications were sent March 20, 2026. Experian IdentityWorks (12 months) was offered to affected individuals.
Maine clockDiscovered Dec 4, 2025 → Filed with AG Mar 20, 2026106d ✗ ME AG >90d15 weeks discovery → filing
⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed1 affectedView incident
Source provenance
- Source URL
- https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/0b458342-f865-4ca9-94b7-1bb1de46afba.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Mar 20, 2026
- Raw hash
- b65975b97ac09fa620beb9ebbc34e69a063365dcd7b4f091feabd6b5c942f84b
Reporting entity
- Name
- A.C. Roman & Associates, Inc.norm: ac roman associates
- Domain
- romansearch.com
- Industry
- Insurance Claims Services
Victim entity
- Name
- A.C. Roman & Associates, Inc.norm: ac roman associates
- Domain
- romansearch.com
- Industry
- Insurance Claims Services
- Industry
- Professional Servicesllm
Incident
- Discovered
- Dec 4, 2025
- Materiality determined
- —
- Notification sent
- Mar 20, 2026
- Affected individuals
- 1
- Data types
- PIIIDENTITY_BASICIDENTITY_GOVERNMENT
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1078 Valid AccountsT1041 Exfiltration Over C2 Channel
- Threat actor
- External
- Regulator citations
- Notified federal law enforcementNotified applicable state regulators
Compliance
- Time to disclose
- 15 weeks(106 days from discovery to filing)
- Compliance flags
- ME AG >90d · 106dME resident >60d · 106d
- Discovery-date grounding
- unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
- Clock breakdown
Statute Window Elapsed Threshold Status Maine Discovered: Dec 4, 2025→ Filed with AG: Mar 20, 2026106d 90 days ME AG >90d Maine Discovered: Dec 4, 2025→ Notified: Mar 20, 2026106d 60 days (analyst band; statutory cap is 30 days) ME resident >60d
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.