HackingCustomer Data InvolvedIDENTITY_BASICFINANCIAL_ACCOUNTMediumContained
CMS Companies
bd_66dd757594b02350 · schema v1 · pii pii-v1
Full breach record for CMS Companies →CMS Companies, a financial services provider based in Wynnewood, PA, reported an external system breach (hacking) occurring between July 17 and July 20, 2021. The incident was discovered on January 4, 2022, affecting 2,284 individuals, including 3 Maine residents. The breach compromised names and financial account numbers (including credit/debit card numbers with security codes/PINs). CMS Companies sent written notifications on February 4, 2022, and provided 24 months of identity theft protection services through IDX.
Maine clockDiscovered Jan 4, 2022 → Filed with AG Feb 4, 202231d ⏱ ME AG >30d4 weeks discovery → filing
⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed2,284 affectedView incident
Source provenance
- Source URL
- https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/23510209-501a-40b4-b828-7b876a3ef4d3.shtml
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Feb 4, 2022
- Raw hash
- 51fc196b0d6f9068ce7a8e5e06a765c4f437297446e7f34d0607647c12747c35
Reporting entity
- Name
- CMS Companiesnorm: cms companies
- Domain
- cmsco.com
- Industry
- Financial Services
Victim entity
- Name
- CMS Companiesnorm: cms companies
- Domain
- cmsco.com
- Industry
- Financial Services
Incident
- Discovered
- Jan 4, 2022
- Materiality determined
- —
- Notification sent
- Feb 4, 2022
- Affected individuals
- 2,284
- Data types
- IDENTITY_BASICFINANCIAL_ACCOUNT
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1190 Exploit Public-Facing Application
- Threat actor
- ExternalFinancial
- Regulator citations
- Filed data breach notice with Maine Attorney General
- Initial access
- exploit_public_facing
Compliance
- Time to disclose
- 4 weeks(31 days from discovery to filing)
- Compliance flags
- ME AG >30d · 31d
- Discovery-date grounding
- unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
- Clock breakdown
Statute Window Elapsed Threshold Status Maine Discovered: Jan 4, 2022→ Filed with AG: Feb 4, 202231d 30 days (soft) ME AG >30d
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.