HackingCustomer Data InvolvedDelayed DiscoveryPIILowContained
CRB GROUP, INC.
bd_5e29086617cf07f2 · schema v1 · pii pii-v1
Full breach record for CRB GROUP, INC. →CRB Group, Inc. (Kansas City, MO) experienced an external system breach (hacking) that occurred on December 25, 2023, discovered on May 29, 2024 — approximately five months later. A total of 1,198 individuals were affected, including 4 Maine residents. Notification was sent on August 21, 2024. TransUnion credit monitoring and identity protection services (12 months) were offered to affected individuals.
Leak gap clock✗ Leak >180d12 weeks discovery → filing
⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
This filing is one of 4 about the same incident.View merged incident
A leak claim by lockbit_3 about this victim predates this filing by 241 days.View originating leak claim
Linked disclosures
Why this link?Regulatory filings (3) · sorted by filing gap
- bd_1b0368e8efedb4bbMontana State AGfiled 2024-08-21Candidate
- bd_49ff40255db6cfb5New Hampshire State AGfiled 2024-08-21Verified
- bd_d7da9110f4502c63Indiana State AGfiled 2024-08-21Verified
Source provenance
- Source URL
- https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/a480d08f-0d45-4874-897e-d8b41bccbf6e.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Aug 21, 2024
- Raw hash
- 3b2ec56e21bc67b112221b20eddca671ee2404ed587271defb20fa79d778861a
Reporting entity
- Name
- CRB GROUP, INC.norm: crb group
- Domain
- crbgroup.com
- Industry
- Other Commercial
Victim entity
- Name
- CRB GROUP, INC.norm: crb group
- Domain
- crbgroup.com
- Industry
- Other Commercial
Incident
- Discovered
- May 29, 2024
- Materiality determined
- —
- Notification sent
- Aug 21, 2024
- Affected individuals
- 4
- Data types
- PII
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1078 Valid Accounts
- Threat actor
- External
Compliance
- Time to disclose
- 12 weeks(84 days from discovery to filing)
- Compliance flags
- Leak >180dME AG >30d · 84dME resident >60d · 84d
- Discovery-date grounding
- unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
- Clock breakdown
Statute Window Elapsed Threshold Status Maine Discovered: May 29, 2024→ Filed with AG: Aug 21, 202484d 30 days (soft) ME AG >30d Maine Discovered: May 29, 2024→ Notified: Aug 21, 202484d 60 days (analyst band; statutory cap is 30 days) ME resident >60d
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.