HackingOtherStolen CredentialsTargetedIdentity (basic)LowContained

Pure Haven, LLC

bd_53f22717546d6dc8 · schema v1 · pii pii-v1

Severity

Low

Discovered

Sep 5, 2025

Filed

Oct 13, 2025

To disclose

5 weeks

Affected · nationwide

73817 in this filing

Linked

7 filings

Confidence

66%

Full breach record for Pure Haven, LLC →2 incidents on file

Pure Haven, LLC reported an external system breach (hacking) on September 2, 2025, discovered on September 5, 2025. The incident involved unauthorized access to an internal account, potentially exposing names and personal identifiers. 738 individuals were affected, including 17 Maine residents. The company reset passwords, engaged third-party investigators, and offered 12 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Sep 5, 2025 → Filed with AG Oct 13, 202538d ⏱ ME AG >30d5 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 3 days

discovery → filing · 5 weeks / 38 days

Sep 2, 2025

Begins

Sep 5, 2025

Discovered

Oct 13, 2025

Filed

vs. sector median

3 wks faster

This filing is one of 7 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (6) · sorted by filing gap

Montana State AGbd_382952dfbf1788f12025-10-13Candidate
Nebraska State AGbd_249e73ff0e66569b2025-10-10 · +3dVerified
Vermont State AGbd_919cc03207e589fb2025-10-10 · +3dVerified
Indiana State AGbd_d8028d274933ede82025-10-10 · +3dVerified

Show 2 more filings ↓up to 7d gap

Massachusetts State AGbd_3d154cd0b4ca47b02025-10-20 · +7dVerified
New Hampshire State AGbd_829aa23f6a3cf3492025-10-20 · +7dVerified

Name: Cipriani & Werner
norm: cipriani werner
Domain: c-wlaw.com

Name: Pure Haven, LLC
norm: pure haven
Industry: Otherllm

Discovered: Sep 5, 2025
Breach occurred: Sep 2, 2025
Undetected for: 3 daysoccurrence → discovery
Materiality determined: —
Notification sent: Oct 10, 2025
Affected individuals: 738state + nationwide
Data types: Identity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Initial access: valid_credentials

During the incident: Performed a password reset
Engaged third-party specialists to assist in conducting a full investigation
Secured our accounts
Changes made: Offering complimentary credit monitoring and identity protection services
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 weeks(38 days from discovery to filing)
Compliance flags: ME AG >30d · 38d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Sep 5, 2025
→ Filed with AG: Oct 13, 2025
38d 30 days (soft) ME AG >30d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Sep 5, 2025 → Filed with AG: Oct 13, 2025	38d	30 days (soft)	ME AG >30d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 7 filings · 7 states

View merged incident ↗

Nebraska State AGOct 10 · first

Vermont State AGOct 10 · first

Indiana State AGOct 10 · first

Montana State AG+3d

Maine State AG+3d · this page

Massachusetts State AG+10d

New Hampshire State AG+10d

Pattern: first filing Oct 10 (NE), last Oct 20 (NH) — a 10-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/cd1938df-14b6-408d-9955-90ed4f88f318.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 13, 2025
Raw hash: b914a90b63b52c5d50272ed2b4d2561006cfdada2d6750f3d2faed635eb33f88

Linked disclosures

Regulatory filings (6) · sorted by filing gap

Reporting entityCipriani & Werner

Victim entityPure Haven, LLC

Incidentdiscovered Sep 5, 2025

Stated responsePerformed a password reset

ComplianceME AG >30d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov