HackingOtherVulnerability ExploitCustomer Data InvolvedIdentity (basic)Financial accountMediumContained

Cross Catholic Outreach, Inc.

bd_59d203a22004df4a · schema v1 · pii pii-v1

Severity

Medium

Discovered

Apr 23, 2024

Filed

Sep 19, 2024

To disclose

21 weeks

Affected · nationwide

2,52015 in this filing

Linked

7 filings

Confidence

66%

Full breach record for Cross Catholic Outreach, Inc. →

Cross Catholic Outreach, Inc. reported an external system breach (hacking) occurring between April 14 and 17, 2024, discovered on April 23, 2024. The incident affected 2,520 individuals total, including 15 Maine residents. Compromised data included names and financial account information. Notices were sent on September 18, 2024, and 12 months of identity protection services were offered.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Apr 23, 2024 → Filed with AG Sep 19, 2024149d ✗ ME AG >90d21 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 9 days

discovery → filing · 21 weeks / 149 days

Apr 14, 2024

Begins

Apr 23, 2024

Discovered

Sep 19, 2024

Filed

vs. sector median

+13 wks slower

This filing is one of 7 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (6) · sorted by filing gap

Vermont State AGbd_a938a47c488029452024-09-18 · +1dVerified
New Hampshire State AGbd_0b1093ebe1544c792024-06-03 · +108dVerified
Montana State AGbd_82706c68b633af452024-06-03 · +108dCandidate
Indiana State AGbd_8dfd5367f7ab12a12024-06-03 · +108dVerified

Show 2 more filings ↓up to 108d gap

Maine State AGbd_aabd6f27eab43d6d2024-06-03 · +108dVerified
Massachusetts State AGbd_af73059ed13e3ebd2024-06-03 · +108dVerified

Name: Cross Catholic Outreach, Inc.
norm: cross catholic outreach

Name: Cross Catholic Outreach, Inc.
norm: cross catholic outreach
Industry: Otherllm

Discovered: Apr 23, 2024
Breach occurred: Apr 14, 2024 – Apr 17, 2024
Undetected for: 9 daysoccurrence → discovery
Materiality determined: —
Notification sent: Sep 18, 2024
Affected individuals: 2,520state + nationwide
Data types: Identity (basic)Financial account
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: ExternalFinancial
Regulator citations: Filed notification with Maine Attorney General
Initial access: exploit_public_facing

During the incident: Provided written notice to affected individuals
Offered 12 months of identity theft protection services through IDX
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 21 weeks(149 days from discovery to filing)
Compliance flags: ME AG >90d · 149dME resident >60d · 148d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Apr 23, 2024
→ Filed with AG: Sep 19, 2024
149d 90 days ME AG >90d
Maine
Discovered: Apr 23, 2024
→ Notified: Sep 18, 2024
148d 60 days (analyst band; statutory cap is 30 days) ME resident >60d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Apr 23, 2024 → Filed with AG: Sep 19, 2024	149d	90 days	ME AG >90d
Maine	Discovered: Apr 23, 2024 → Notified: Sep 18, 2024	148d	60 days (analyst band; statutory cap is 30 days)	ME resident >60d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 7 filings · 6 states

View merged incident ↗

New Hampshire State AGJun 3 · first

Montana State AGJun 3 · first

Indiana State AGJun 3 · first

Maine State AGJun 3 · first

Massachusetts State AGJun 3 · first

Vermont State AG+107d

Maine State AG+108d · this page

Pattern: first filing Jun 3 (NH), last Sep 19 (ME) — a 108-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/f02867d1-3733-48d5-9c4a-f7fe316a90de.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 19, 2024
Raw hash: 6222fa0ad51334706fa768418f4706c0a9784b7d48e991b897ad008c432289eb

Linked disclosures

Regulatory filings (6) · sorted by filing gap

Reporting entityCross Catholic Outreach, Inc.

Victim entityCross Catholic Outreach, Inc.

Incidentdiscovered Apr 23, 2024

Stated responseProvided written notice to affected individuals

ComplianceME AG >90d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov