HackingOtherVulnerability ExploitStolen CredentialsMulti-Stage ChainData ExfiltratedCustomer Data InvolvedPIIIdentity (basic)MediumContained

The Gladney Center for Adoption

bd_5dbfd77f0c86a22f · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jan 23, 2026

Filed

Feb 6, 2026

To disclose

14 days

Affected · nationwide

3,69314 in this filing

Linked

8 filings

Confidence

65%

Full breach record for The Gladney Center for Adoption →

The Gladney Center for Adoption experienced two security incidents in 2025: an external system breach (hacking) in February and a third-party system vulnerability in April. The breach was discovered on January 23, 2026, affecting 3,693 individuals, including 14 Maine residents. Personal information including names and identifiers was potentially accessed. Gladney engaged external cybersecurity professionals, notified federal law enforcement, and offered 12 months of identity monitoring via Kroll.

J jump to incidentP pin to compareR raw source

Date basis clock✓ Clock withheld · confirmation date14 days discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 356 days

discovery → filing · 14 days

Feb 1, 2025

Begins

Jan 23, 2026

Discovered

Feb 6, 2026

Filed

vs. sector median

6 wks faster

This filing is one of 8 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (7) · sorted by filing gap

Texas State AGbd_1ddc7cc07cab79bf2026-02-06Verified
New Hampshire State AGbd_36de3c5e0c9276352026-02-06Verified
Massachusetts State AGbd_5d234d2bfc0ac1ca2026-02-09 · +3dVerified
Indiana State AGbd_3808790bfc36f40b2026-02-03 · +3dCandidate

Show 3 more filings ↓up to 3d gap

Nebraska State AGbd_3f9a6e198c38e1802026-02-03 · +3dVerified
Indiana State AGbd_a6c9b3e81c3307a02026-02-03 · +3dCandidate
Vermont State AGbd_ecdeaca458829da42026-02-03 · +3dVerified

Name: MCDONALD HOPKINS LLC
norm: mcdonald hopkins

Name: The Gladney Center for Adoption
norm: the gladney center for adoption
Domain: mygladney.com
Industry: Otherllm

Discovered: Jan 23, 2026
Breach occurred: Feb 1, 2025 – Apr 30, 2025
Undetected for: 356 daysoccurrence → discovery
Materiality determined: —
Notification sent: Feb 3, 2026
Affected individuals: 3,693state + nationwide
Data types: PIIIdentity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1078 Valid Accounts
Threat actor: External
Regulator citations: Filed notification with Maine Attorney General
Initial access: exploit_public_facing

During the incident: Commenced a prompt and thorough investigation separately for each incident
Worked closely with external cybersecurity professionals
Notified federal law enforcement of the incidents
Reviewed existing policies and training protocols relating to data protection
Enhanced security measures and monitoring tools
Switched out systems that no longer serve their purpose
Manually reviewed documents to identify affected individuals
Changes made: Enhanced security measures and monitoring tools
Switched out systems that no longer serve their purpose and comply with strict data protection measures
Continually evaluate and modify practices and internal controls to enhance security and privacy
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 14 days(14 days from discovery to filing)
Compliance flags: Clock withheld · confirmation date

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 8 filings · 7 states

View merged incident ↗

Indiana State AGFeb 3 · first

Nebraska State AGFeb 3 · first

Indiana State AGFeb 3 · first

Vermont State AGFeb 3 · first

Texas State AG+3d

New Hampshire State AG+3d

Maine State AG+3d · this page

Massachusetts State AG+6d

Pattern: first filing Feb 3 (IN), last Feb 9 (MA) — a 6-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/4fe222ad-0992-483c-954f-70c10623831a.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 6, 2026
Raw hash: 7e75dcdce0b3dcd1f0938de33522de79281b0db15c379c22d8566a22110f7fe6

Linked disclosures

Regulatory filings (7) · sorted by filing gap

Reporting entityMCDONALD HOPKINS LLC

Victim entityThe Gladney Center for Adoption

Incidentdiscovered Jan 23, 2026

Stated responseCommenced a prompt and thorough investigation separately for each incident

ComplianceClock withheld · confirmation date

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov