HackingRetail & ConsumerRetailData ExfiltratedTargetedIdentity (basic)Government IDHighContained

BROWNELL TRAVEL, INC.

bd_57ae9d4f41e43542 · schema v1 · pii pii-v1

Severity

High

Discovered

Jun 6, 2024

Filed

Jul 31, 2024

To disclose

8 weeks

Affected · nationwide

12,8673 in this filing

Linked

7 filings

Confidence

65%

Full breach record for BROWNELL TRAVEL, INC. →

Brownell Travel, Inc. reported an external system breach (hacking) occurring between November 10 and November 26, 2023. The incident was discovered on June 6, 2024. Approximately 12,867 individuals were affected, including 3 Maine residents. The breach involved unauthorized access to systems containing names and government identifiers. Brownell notified affected individuals on July 31, 2024, and offered 24 months of credit monitoring through Experian.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Jun 6, 2024 → Filed with AG Jul 31, 202455d ⏱ ME AG >30d8 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 209 days

discovery → filing · 8 weeks / 55 days

Nov 10, 2023

Begins

Jun 6, 2024

Discovered

Jul 31, 2024

Filed

vs. sector median

on median

This filing is one of 7 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (6) · sorted by filing gap

California State AGbd_10394f70c9ad3aac2024-07-31Verified
Montana State AGbd_440eee3860dbbedd2024-07-31Candidate
New Hampshire State AGbd_7993e694c089549a2024-07-31Verified
Vermont State AGbd_b24e42340ba6d5bb2024-07-31Verified

Show 2 more filings ↓up to 1d gap

Massachusetts State AGbd_fe566bd813a5fbe02024-07-31Verified
Indiana State AGbd_1147a1aecc199bfc2024-07-30 · +1dVerified

Name: BROWNELL TRAVEL, INC.
norm: brownell travel
Domain: brownelltravel.com
Industry: Travel Services

Name: BROWNELL TRAVEL, INC.
norm: brownell travel
Domain: brownelltravel.com
Industry: Travel Services
Industry: Retail & Consumerllm

Discovered: Jun 6, 2024
Breach occurred: Nov 10, 2023 – Nov 26, 2023
Undetected for: 209 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jul 31, 2024
Affected individuals: 12,867state + nationwide
Data types: Identity (basic)Government ID
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1078 Valid Accounts
Threat actor: External
Regulator citations: Reported event to federal law enforcement
Initial access: exploit_public_facing

During the incident: Secured systems
Restored access to systems
Worked with cybersecurity specialists to investigate
Reported event to federal law enforcement
Conducted comprehensive third-party review of information
Undertook manual review of records
Changes made: Enhancing security measures
Reviewed security policies and procedures
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 weeks(55 days from discovery to filing)
Compliance flags: ME AG >30d · 55d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Jun 6, 2024
→ Filed with AG: Jul 31, 2024
55d 30 days (soft) ME AG >30d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Jun 6, 2024 → Filed with AG: Jul 31, 2024	55d	30 days (soft)	ME AG >30d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 7 filings · 7 states

View merged incident ↗

Indiana State AGJul 30 · first

California State AG+1d

Montana State AG+1d

New Hampshire State AG+1d

Vermont State AG+1d

Massachusetts State AG+1d

Maine State AG+1d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/27c44cba-7fbd-4004-b42a-bdd0b7b670a8.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 31, 2024
Raw hash: 2796ba2512841b896f1368c02cebbbb15d1d2f8205669d82049ee87c40ecf39a

Linked disclosures

Regulatory filings (6) · sorted by filing gap

Reporting entityBROWNELL TRAVEL, INC.

Victim entityBROWNELL TRAVEL, INC.

Incidentdiscovered Jun 6, 2024

Stated responseSecured systems

ComplianceME AG >30d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov