HackingOtherStolen CredentialsData ExfiltratedFinancial accountIdentity (basic)Government IDPHIHealth (basic)HighContained

Dulcich, Inc.

bd_551f06b9dc1db169 · schema v1 · pii pii-v1

Severity

High

Discovered

Jun 24, 2024

Filed

Oct 14, 2025

To disclose

16 months

Affected

10,761state residents only

Linked

11 filings

Confidence

70%

Full breach record for Dulcich, Inc. →

Dulcich, Inc. reported unauthorized network access occurring June 24-25, 2024. The incident was detected on June 24, 2024. The breach affected 10,761 Washington residents, involving full names. Dulcich contained the incident, engaged forensic investigators, and notified the FBI. Affected individuals were offered credit monitoring services.

J jump to incidentP pin to compareR raw source

Washington clock✗ WA AG >90d16 months discovery → filing

⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Incident timeline

discovery → filing · 16 months / 477 days

Jun 24, 2024

Begins

Jun 24, 2024

Discovered

Oct 14, 2025

Filed

vs. sector median

+60 wks slower

This filing is one of 11 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (10) · sorted by filing gap

Maine State AGbd_0216d6506e6802962025-10-14Candidate
Montana State AGbd_1239faefddba161c2025-10-14Verified
Oregon State AGbd_3a0e057df921610d2025-10-14Verified
Vermont State AGbd_4ec290f1d656cd5f2025-10-14Verified

Show 6 more filings ↓up to 6d gap

Nebraska State AGbd_b560938a8c4de7972025-10-14Verified
Indiana State AGbd_d6aac9753c52fa002025-10-14Verified
California State AGbd_eaf989bf564b5f802025-10-14Verified
Massachusetts State AGbd_9f63546478fa39f82025-10-15 · +1dVerified
Texas State AGbd_367e3fa6887321c62025-10-16 · +2dVerified
New Hampshire State AGbd_61fef1f061261ef62025-10-20 · +6dVerified

Name: Dulcich, Inc.
norm: dulcich

Name: Dulcich, Inc.
norm: dulcich
Industry: Otherllm

Discovered: Jun 24, 2024
Breach occurred: Jun 24, 2024 – Jun 25, 2024
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 10,761state-resident count only
Data types: Identity (basic)
Data elements: NameSocial Security numberDriver's licence numberFinancial account numberPassport numberHealth insurance IDMedical information
WA-stated cause: Unauthorized Access
WA-stated duration: lifecycle 1-99dexposure 1-99d
WA-stated discovery: Found while ongoing
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: Reported the incident to the Federal Bureau of Investigation
Initial access: valid_credentials

During the incident: Contained the incident
Reported the incident to the Federal Bureau of Investigation
Engaged external cybersecurity professionals
Changes made: Offering complimentary months membership of Experian IdentityWorksSM Credit 3B
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 16 months(477 days from discovery to filing)
Compliance flags: WA AG >90d
Discovery-date grounding: occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 11 filings · 11 states

View merged incident ↗

Maine State AGOct 14 · first

Montana State AGOct 14 · first

Oregon State AGOct 14 · first

Vermont State AGOct 14 · first

Nebraska State AGOct 14 · first

Indiana State AGOct 14 · first

California State AGOct 14 · first

Washington State AGOct 14 · first · this page

Massachusetts State AG+1d

Texas State AG+2d

New Hampshire State AG+6d

Pattern: first filing Oct 14 (ME), last Oct 20 (NH) — a 6-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA34950.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 14, 2025
Raw hash: ab79062aa252c4cf772881f51388a6e5a905fbd857817b0394e2ae25aa7f5334

Linked disclosures

Regulatory filings (10) · sorted by filing gap

Reporting entityDulcich, Inc.

Victim entityDulcich, Inc.

Incidentdiscovered Jun 24, 2024

Stated responseContained the incident

ComplianceWA AG >90d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com