HackingStolen CredentialsSupply Chain (3P Vendor)Data ExfiltratedPIIIDENTITY_BASICMediumContained
Maximus
bd_5312733f463970a3 · schema v1 · pii pii-v1
Full breach record for Maximus →Maximus, Inc. submitted a supplemental data security incident update to the Idaho Attorney General on January 10, 2024, regarding a breach involving MOVEit Transfer. The incident affected 20,513 Idaho residents. Maximus offered 24 months of credit monitoring and identity restoration services through Experian and notified consumer reporting agencies. The investigation is concluded.
Leak gap clock⏱ Leak >90d
⚠ no discovery dateNo discovery date was extracted, so no notification clock can be evaluated.
This filing is one of 3 about the same incident.View merged incident
A leak claim by cl0p about this victim predates this filing by 168 days.View originating leak claim
Linked disclosures
Why this link?Ransomware claims (1)
- bd_08c05ac3d136140dLeak Sitecl0pfiled 2023-07-26(168d gap)Candidate
Regulatory filings (1) · sorted by filing gap
- bd_d4deac1eb085d27aWashington State AGfiled 2023-08-25(138d gap)Verified
Source provenance
- Source URL
- https://www.ag.idaho.gov/content/uploads/2024/01/1-10-2024-Maximus-Inc.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Jan 10, 2024
- Raw hash
- ccc1fe6abc4ebfa57ac5cc1c3b8b0577e1f11fbbf84b4d8ea671eb96cd3b6867
Reporting entity
- Name
- Maximusnorm: maximus
- Domain
- maximus.com
Victim entity
- Name
- Maximusnorm: maximus
- Domain
- maximus.com
Incident
- Discovered
- —
- Materiality determined
- —
- Notification sent
- Jan 10, 2024
- Affected individuals
- 20,513
- Data types
- PIIIDENTITY_BASIC
- Attack vector
- Third-Party / Supply Chain
- MITRE ATT&CK
- T1195 Supply Chain Compromise
- Threat actor
- ExternalFinancial
- Regulator citations
- Notified Idaho Attorney General's Office on July 28, 2023
- Third party
- via Progress Software
- Initial access
- supply_chain
Compliance
- Compliance flags
- Leak >90d
- Discovery-date grounding
- no discovery dateNo discovery date was extracted, so no notification clock can be evaluated.
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.