MalwareRetail & ConsumerRetailRansomwareData EncryptedTargetedIdentity (basic)OtherMediumContained

Crossroads Trading Co., Inc.

bd_630daf08ddfcdf2b · schema v1 · pii pii-v1

Severity

Medium

Discovered

Mar 7, 2025

Filed

Mar 25, 2025

To disclose

18 days

Affected · nationwide

60,04127 in this filing

Linked

13 filings

Confidence

66%

Full breach record for Crossroads Trading Co., Inc. →

Crossroads Trading Co., Inc. reported an external system breach (hacking) on February 15, 2025, where an unauthorized third party gained access to its server and encrypted data. The incident was discovered on March 7, 2025. Approximately 60,041 individuals were affected, including 27 Maine residents. The company engaged forensic investigators, secured its network, and reported the incident to the FBI. Affected individuals were offered two years of Experian IdentityWorks services.

J jump to incidentP pin to compareR raw source

Leak gap clock⏱ Leak >30d18 days discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 20 days

discovery → filing · 18 days

Feb 15, 2025

Begins

Mar 7, 2025

Discovered

Mar 25, 2025

Filed

vs. sector median

5 wks faster

This filing is one of 13 about the same incident.View merged incident

A leak claim by qilin about this victim predates this filing by 32 days.View originating leak claim

Linked disclosures

Why this link?

Regulatory filings (10) · sorted by filing gap

Montana State AGbd_4fbca7fbfafbb4342025-03-25Candidate
Massachusetts State AGbd_78ec4bcb30006bdf2025-03-25Verified by operator
California State AGbd_8680c7a67346983a2025-03-25Verified
Oregon State AGbd_8df3d41e3a5b18032025-03-25Verified

Show 6 more filings ↓up to 394d gap

Vermont State AGbd_9903b9cec62fd77f2025-03-25Verified
New Hampshire State AGbd_df93c63fabff12292025-03-25Verified
Indiana State AGbd_e43b19b7cc87dc6b2025-03-25Verified
Nebraska State AGbd_e7115a7a8f4bf5382025-03-25Verified
Illinois State AGbd_1f73f152d85ddc0f2025-04-01 · +7dVerified
Maryland State AGbd_638e747090bb3c462026-04-23 · +394dVerified

Showing first 10 of 12 linked disclosures.

Name: Crossroads Trading Co., Inc.
norm: crossroads trading
Domain: crossroadstrading.com

Name: Crossroads Trading Co., Inc.
norm: crossroads trading
Domain: crossroadstrading.com
Industry: Retail & Consumerllm

Discovered: Mar 7, 2025
Breach occurred: Feb 15, 2025
Undetected for: 20 daysoccurrence → discovery
Materiality determined: —
Notification sent: Mar 25, 2025
Affected individuals: 60,041state + nationwide
Data types: Identity (basic)Other
Attack vector: Unauthorized Access
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Reported incident to FBI
Initial access: valid_credentials

During the incident: Retained a team of expert forensic investigators
Engaged a cyberthreat firm
Secured network and restored systems
Reported incident to and met with the FBI
Offered two years of identity protection services through Experian
Changes made: Secured network
Restored systems
Prevented further access by the third-party
Took affirmative steps to prevent the encrypted data from being published, distributed or misused
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 18 days(18 days from discovery to filing)
Compliance flags: Leak >30dME AG ≤30d · 18d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Mar 7, 2025
→ Filed with AG: Mar 25, 2025
18d 30 days ME AG ≤30d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Mar 7, 2025 → Filed with AG: Mar 25, 2025	18d	30 days	ME AG ≤30d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 11 filings · 11 states

View merged incident ↗

Montana State AGMar 25 · first

Massachusetts State AGMar 25 · first

California State AGMar 25 · first

Oregon State AGMar 25 · first

Vermont State AGMar 25 · first

New Hampshire State AGMar 25 · first

Indiana State AGMar 25 · first

Nebraska State AGMar 25 · first

Maine State AGMar 25 · first · this page

Illinois State AG+7d

Maryland State AG+394d

Pattern: first filing Mar 25 (MT), last Apr 23 (MD) — a 394-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Cascade drawn from the first 10 linked disclosures of 12 — the full spread may be wider.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/6a3ad897-f2c7-485b-a2aa-8b687d7dda10.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 25, 2025
Raw hash: d179a92f29ace5b6156542ee5a0fcc35dfac921e35e9da3055ea792d19577388

Linked disclosures

Regulatory filings (10) · sorted by filing gap

Reporting entityCrossroads Trading Co., Inc.

Victim entityCrossroads Trading Co., Inc.

Incidentdiscovered Mar 7, 2025

Stated responseRetained a team of expert forensic investigators

ComplianceLeak >30d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov