HackingGovernmentGovernmentData ExfiltratedTargetedIdentity (basic)Government IDHighContained

Town of Milford

bd_57f8c6be6db21a32 · schema v1 · pii pii-v1

Severity

High

Discovered

Nov 18, 2024

Filed

Mar 10, 2025

To disclose

16 weeks

Affected · nationwide

2,0894 in this filing

Linked

2 filings

Confidence

66%

Full breach record for Town of Milford →

The Town of Milford, Massachusetts, experienced an external system breach (hacking) on November 18, 2024, resulting in the unauthorized acquisition of files containing names and Social Security numbers. Approximately 2,089 individuals were affected, including 4 Maine residents. The Town engaged cybersecurity experts, notified the FBI, and provided 24 months of credit monitoring and identity protection services to impacted individuals.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Nov 18, 2024 → Filed with AG Mar 10, 2025112d ⏱ ME AG >30d16 weeks discovery → filing

⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Incident timeline

discovery → filing · 16 weeks / 112 days

Nov 18, 2024

Begins

Nov 18, 2024

Discovered

Mar 10, 2025

Filed

This filing is one of 2 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Massachusetts State AGbd_c16f90dad3d029752025-03-10Verified

Name: Town of Milford
norm: town of milford

Name: Town of Milford
norm: town of milford
Industry: Governmentllm

Discovered: Nov 18, 2024
Breach occurred: Nov 18, 2024
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Mar 10, 2025
Affected individuals: 2,089state + nationwide
Data types: Identity (basic)Government ID
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Reported the incident to the Federal Bureau of Investigation
Initial access: exploit_public_facing

During the incident: Took steps to secure its network
Engaged leading cybersecurity experts to investigate
Reported the incident to the Federal Bureau of Investigation
Cooperating with its investigation
Providing complimentary credit monitoring and identity protection services
Established a toll-free call center
Changes made: Implemented additional security measures in its environment to reduce the risk of a similar incident occurring in the future
Enhanced security posture
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 16 weeks(112 days from discovery to filing)
Compliance flags: ME AG >30d · 112d
Discovery-date grounding: occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Nov 18, 2024
→ Filed with AG: Mar 10, 2025
112d 30 days (soft) ME AG >30d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Nov 18, 2024 → Filed with AG: Mar 10, 2025	112d	30 days (soft)	ME AG >30d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Massachusetts State AGMar 10 · first

Maine State AGMar 10 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/6cfd8ba6-7738-4e18-aab0-a51b7bfb5470.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 10, 2025
Raw hash: 5a182e6b8d7a52ab38c0f3105966ecd075913ea66867061543b44b1350588512

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityTown of Milford

Victim entityTown of Milford

Incidentdiscovered Nov 18, 2024

Stated responseTook steps to secure its network

ComplianceME AG >30d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov