Social EngineeringFinancial ServicesFinancePhishingStolen CredentialsData ExfiltratedCustomer Data InvolvedDelayed DiscoveryIdentity (basic)Government IDHighContained

Legacy Capital Advisors LLC

bd_64d58128659d178f · schema v1 · pii pii-v1

Severity

High

Discovered

Sep 25, 2023

Filed

Aug 27, 2024

To disclose

48 weeks

Affected · nationwide

3,3556 in this filing

Linked

4 filings

Confidence

66%

Full breach record for Legacy Capital Advisors LLC →

Legacy Capital Advisors LLC reported a data breach where unauthorized actors accessed employee email accounts starting in late July 2023 after suspicious activity was discovered on September 25, 2023. The incident affected 3,355 individuals, exposing names and Social Security numbers. Legacy engaged forensic specialists, notified law enforcement, and provided one year of credit monitoring to affected individuals. Notices were sent on August 26, 2024.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Sep 25, 2023 → Filed with AG Aug 27, 2024337d ✗ ME AG >90d48 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 56 days

discovery → filing · 48 weeks / 337 days

Jul 31, 2023

Begins

Sep 25, 2023

Discovered

Aug 27, 2024

Filed

vs. sector median

+40 wks slower

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Massachusetts State AGbd_7c00a7112969afcf2024-08-27Verified
Vermont State AGbd_a8923cda36790b122024-08-27Candidate
Indiana State AGbd_a8db4eab2d4a96382024-08-26 · +1dVerified

Name: Legacy Capital Advisors LLC
norm: legacy capital advisors
Domain: yourlegacyteam.com
Industry: Financial Services

Name: Legacy Capital Advisors LLC
norm: legacy capital advisors
Domain: yourlegacyteam.com
Industry: Financial Services
Industry: Financial Servicesllm

Discovered: Sep 25, 2023
Breach occurred: Jul 31, 2023
Undetected for: 56 daysoccurrence → discovery
Materiality determined: —
Notification sent: Aug 26, 2024
Affected individuals: 3,355state + nationwide
Data types: Identity (basic)Government ID
Data elements: Social Security numberDate of birth
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid AccountsT1114 Email Collection
Threat actor: ExternalFinancial
Regulator citations: Provided written notice of this incident to state regulators, as necessary
Initial access: phishing_link

During the incident: Initiated an investigation into the nature and scope of the event with the assistance of third-party forensic specialists
Secured the affected account
Conducted a comprehensive review of the contents of the accounts
Notified federal law enforcement of the event
Implemented additional safeguards to help prevent similar incidents from occurring in the future
Provided individuals whose personal information was potentially affected by this incident with access to credit monitoring services for one (1) year through Experian at no cost to the individuals
Provided impacted individuals with guidance on how to better protect against identity theft and fraud
Posted notice of the event on the homepage of its website
Published a media notice throughout the state of Georgia
Changes made: Implemented additional safeguards to help prevent similar incidents from occurring in the future
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 48 weeks(337 days from discovery to filing)
Compliance flags: ME AG >90d · 337dME resident >180d · 336d
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Sep 25, 2023
→ Filed with AG: Aug 27, 2024
337d 90 days ME AG >90d
Maine
Discovered: Sep 25, 2023
→ Notified: Aug 26, 2024
336d 180 days ME resident >180d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Sep 25, 2023 → Filed with AG: Aug 27, 2024	337d	90 days	ME AG >90d
Maine	Discovered: Sep 25, 2023 → Notified: Aug 26, 2024	336d	180 days	ME resident >180d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Indiana State AGAug 26 · first

Massachusetts State AG+1d

Vermont State AG+1d

Maine State AG+1d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/49411e05-2e3b-41cd-b7db-766df3b08469.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 27, 2024
Raw hash: 1a302a3f9d1c67c66db0560fced34b6de9481ab13618760e814a5f793a3c8c7d

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityLegacy Capital Advisors LLC

Victim entityLegacy Capital Advisors LLC

Incidentdiscovered Sep 25, 2023

Stated responseInitiated an investigation into the nature and scope of the event with the assistance of third-party forensic specialists

ComplianceME AG >90d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov