HackingFinancial ServicesFinanceStolen CredentialsSupply Chain (3P Vendor)Customer Data InvolvedIdentity (basic)Government IDMediumContained

Lyon Services Corp.

bd_4c1288f15be191f8 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Aug 26, 2024

Filed

Sep 3, 2024

To disclose

8 days

Affected · nationwide

2171 in this filing

Linked

2 filings

Confidence

67%

Full breach record for Lyon Services Corp. →

Lyon Services Corp. dba Lyon Financial reported a third-party provider breach on July 8, 2024, discovered August 26, 2024. 217 individuals affected, including 1 Maine resident. Data exposed: names, SSNs, driver's licenses. Notification sent August 30, 2024. Forensic investigation engaged; credit monitoring offered.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Aug 26, 2024 → Filed with AG Sep 3, 20248d ✓ ME AG ≤30d8 days discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 49 days

discovery → filing · 8 days

Jul 8, 2024

Begins

Aug 26, 2024

Discovered

Sep 3, 2024

Filed

vs. sector median

7 wks faster

This filing is one of 2 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Indiana State AGbd_fdf3debb1fb96fb92024-08-30 · +4dCandidate

Name: Lyon Services Corp.
norm: lyon services
Industry: Financial Services

Name: Lyon Services Corp.
norm: lyon services
Industry: Financial Services
Also named: Lyon Services Corp.dba oflegal entity
Lyon Financialdba oftrade name
Industry: Financial Servicesllm

Discovered: Aug 26, 2024
Breach occurred: Jul 8, 2024
Undetected for: 49 daysoccurrence → discovery
Materiality determined: —
Notification sent: Aug 30, 2024
Affected individuals: 217state + nationwide
Data types: Identity (basic)Government ID
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain Compromise
Threat actor: ExternalFinancial
Regulator citations: Notified federal law enforcement
Third party: via Third-party provider
Initial access: supply_chain

During the incident: Engaged a cybersecurity firm to investigate
Conducted a comprehensive review of the impacted data
Retained cybersecurity experts and launched a forensics investigation
Reported this incident to federal law enforcement
Notified affected individuals by letter
Offered complimentary identity protection services
Changes made: Implemented additional security measures to further harden its environment
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 days(8 days from discovery to filing)
Compliance flags: ME AG ≤30d · 8d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Aug 26, 2024
→ Filed with AG: Sep 3, 2024
8d 30 days ME AG ≤30d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Aug 26, 2024 → Filed with AG: Sep 3, 2024	8d	30 days	ME AG ≤30d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Indiana State AGAug 30 · first

Maine State AG+4d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/918c940a-9a4a-40bf-83cb-d3c103838c53.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 3, 2024
Raw hash: 63464f282de0ab73bed1281c0d3f7867911c0835c8969974c36e3e771f904246

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityLyon Services Corp.

Victim entityLyon Services Corp.

Incidentdiscovered Aug 26, 2024

Stated responseEngaged a cybersecurity firm to investigate

ComplianceME AG ≤30d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov