HackingProfessional ServicesProfessional ServicesTargetedIdentity (basic)Government IDMediumContained

William C Smith and Company

bd_56f0b4a919691700 · schema v1 · pii pii-v1

Severity

Medium

Discovered

May 18, 2025

Filed

Jan 12, 2026

To disclose

34 weeks

Affected

3state residents only

Linked

5 filings

Confidence

65%

Full breach record for William C Smith and Company →

William C. Smith and Company reported an external system breach (hacking) occurring on May 5, 2025, discovered on May 18, 2025. The incident affected 3 Maine residents. The company notified the Maine Attorney General and provided 12 months of Experian IdentityWorks services to affected individuals.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 13 days

discovery → filing · 34 weeks / 239 days

May 5, 2025

Begins

May 18, 2025

Discovered

Jan 12, 2026

Filed

vs. sector median

+15 wks slower

This filing is one of 5 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Vermont State AGbd_25c5ba185c56f6062026-01-12Verified
Massachusetts State AGbd_7cc212da57ce3c8d2026-01-12Verified
Indiana State AGbd_66202ec12ea406782026-01-09 · +3dCandidate
Indiana State AGbd_f30f9d046daa93a72026-01-09 · +3dCandidate

Name: William C Smith and Company
norm: william c smith and

Name: William C Smith and Company
norm: william c smith and
Industry: Professional Servicesllm

Discovered: May 18, 2025
Breach occurred: May 5, 2025
Undetected for: 13 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jan 12, 2025
Affected individuals: 3state-resident count only
Data types: Identity (basic)Government ID
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1078 Valid Accounts
Threat actor: External
Regulator citations: Filed breach notification with Maine Attorney General
Initial access: exploit_public_facing

During the incident: Sent written notification to affected individuals
Offered 12 months of Experian IdentityWorks identity theft protection services
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 34 weeks(239 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 4 states

View merged incident ↗

Indiana State AGJan 9 · first

Vermont State AG+3d

Massachusetts State AG+3d

Maine State AG+3d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/4bc02eab-5609-4286-9d19-c55aa4b55809.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 12, 2026
Raw hash: 8e183802e14f53a5a6928111c286f186ce86e6a5af869bd759aa4393ae167f82

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityWilliam C Smith and Company

Victim entityWilliam C Smith and Company

Incidentdiscovered May 18, 2025

Stated responseSent written notification to affected individuals

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov