HackingFinancial ServicesFinanceStolen CredentialsCapture App DataData ExfiltratedCustomer Data InvolvedDelayed DiscoveryPIICREDENTIALSFINANCIALIDENTITY_GOVERNMENTMediumResolved
Penobscot Wealth Management, PA
bd_517bd528020d6abc · schema v1 · pii pii-v1
Full breach record for Penobscot Wealth Management, PA →Penobscot Wealth Management, PA reported an external breach involving unauthorized access to two employees' email accounts between July 16 and August 28, 2024. The breach was discovered on October 28, 2024. Exposed data for 811 Maine residents included names, Social Security numbers, driver's license numbers, state-issued ID numbers, financial account numbers, payment card numbers, online account passwords, and/or dates of birth. Equifax credit monitoring was offered to affected individuals.
Maine clockDiscovered Oct 28, 2024 → Filed with AG Jan 7, 202571d ⏱ ME AG >30d10 weeks discovery → filing
⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
This filing is one of 3 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (2) · sorted by filing gap
- bd_1633b4364a7d0264Indiana State AGfiled 2025-01-07Verified
- bd_80343bd962a01f7aVermont State AGfiled 2025-01-07Verified
Source provenance
- Source URL
- https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/3ddd317b-ec16-4bd9-ad3d-cf1279931920.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Jan 7, 2025
- Raw hash
- 9da596e9f64fa770a25f7029fe9cd55a00c3e327a48f5ef50256fd090fd11d30
Reporting entity
- Name
- Penobscot Wealth Management, PAnorm: penobscot wealth management
- Industry
- Financial Services
Victim entity
- Name
- Penobscot Wealth Management, PAnorm: penobscot wealth management
- Industry
- Financial Services
- Industry
- Financial Servicesllm
Incident
- Discovered
- Oct 28, 2024
- Materiality determined
- —
- Notification sent
- Jan 7, 2025
- Affected individuals
- 811
- Data types
- PIICREDENTIALSFINANCIALIDENTITY_GOVERNMENT
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1078 Valid AccountsT1114 Email Collection
- Threat actor
- External
Compliance
- Time to disclose
- 10 weeks(71 days from discovery to filing)
- Compliance flags
- ME AG >30d · 71dME resident >60d · 71d
- Discovery-date grounding
- unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
- Clock breakdown
Statute Window Elapsed Threshold Status Maine Discovered: Oct 28, 2024→ Filed with AG: Jan 7, 202571d 30 days (soft) ME AG >30d Maine Discovered: Oct 28, 2024→ Notified: Jan 7, 202571d 60 days (analyst band; statutory cap is 30 days) ME resident >60d
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.