HackingFinancial ServicesFinanceCustomer Data InvolvedTargetedIdentity (basic)Government IDHighContained

PennantPark Investment Advisers, LLC

bd_69b5e85cc2e8e9bc · schema v1 · pii pii-v1

Severity

High

Discovered

Jun 12, 2025

Filed

Jun 30, 2025

To disclose

18 days

Affected · nationwide

3,6552 in this filing

Linked

9 filings

Confidence

65%

Full breach record for PennantPark Investment Advisers, LLC →

PennantPark Investment Advisers, LLC reported an external system breach (hacking) occurring between Dec 22, 2024 and Mar 7, 2025. Discovered June 12, 2025. Affected 3,655 individuals (2 in Maine). Data involved personal identifiers. Notification sent June 30, 2025. Remediation included third-party review and enhanced security measures.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Jun 12, 2025 → Filed with AG Jun 30, 202518d ✓ ME AG ≤30d18 days discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 172 days

discovery → filing · 18 days

Dec 22, 2024

Begins

Jun 12, 2025

Discovered

Jun 30, 2025

Filed

vs. sector median

7 wks faster

This filing is one of 9 about the same incident.View merged incident

Linked disclosures

Why this link?

Ransomware claims (2)

Leak Siteakirabd_fb499c43a3c6f83d2025-07-07 · +8dVerified
Leak Siteakirabd_78ace09df5192e152025-06-25 · +5dVerified

Regulatory filings (6) · sorted by filing gap

Massachusetts State AGbd_426e03757de9a2fd2025-06-30Verified
Nebraska State AGbd_4c22865a4a57c5412025-06-30Verified
Indiana State AGbd_9e4c8fbd232238432025-06-30Verified
Texas State AGbd_c34e3deec4ac408a2025-07-03 · +3dVerified

Show 2 more filings ↓up to 95d gap

New Hampshire State AGbd_fe7f24465ecb5e2e2025-06-27 · +3dVerified
Massachusetts State AGbd_8225424a5a67c4ef2025-10-03 · +95dVerified

Name: PennantPark Investment Advisers, LLC
norm: pennantpark investment advisers
Domain: pennantpark.com
Industry: Financial Services

Name: PennantPark Investment Advisers, LLC
norm: pennantpark investment advisers
Domain: pennantpark.com
Industry: Financial Services
Industry: Financial Servicesllm

Discovered: Jun 12, 2025
Breach occurred: Dec 22, 2024 – Mar 7, 2025
Undetected for: 172 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jun 30, 2025
Affected individuals: 3,655state + nationwide
Data types: Identity (basic)Government ID
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1078 Valid Accounts
Threat actor: External
Initial access: exploit_public_facing

During the incident: Undertook a review, working with third-party experts, to determine the nature and scope of the unauthorized access and confirm it was contained
Implemented additional security measures to help further protect against this type of incident going forward
Offering complimentary access to identity theft protection services through IDX at no cost to you
Changes made: Implemented additional security measures to help further protect against this type of incident going forward
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 18 days(18 days from discovery to filing)
Compliance flags: ME AG ≤30d · 18d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Jun 12, 2025
→ Filed with AG: Jun 30, 2025
18d 30 days ME AG ≤30d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Jun 12, 2025 → Filed with AG: Jun 30, 2025	18d	30 days	ME AG ≤30d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 7 filings · 6 states

View merged incident ↗

New Hampshire State AGJun 27 · first

Massachusetts State AG+3d

Nebraska State AG+3d

Indiana State AG+3d

Maine State AG+3d · this page

Texas State AG+6d

Massachusetts State AG+98d

Pattern: first filing Jun 27 (NH), last Oct 3 (MA) — a 98-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/a7a2a6c4-a132-4639-928f-57a72ca0e5ec.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 30, 2025
Raw hash: 0ad367e42df966edac6c9b826bc2dd3382ac84eef39f4b47cbef934f95efa8c6

Linked disclosures

Ransomware claims (2)

Regulatory filings (6) · sorted by filing gap

Reporting entityPennantPark Investment Advisers, LLC

Victim entityPennantPark Investment Advisers, LLC

Incidentdiscovered Jun 12, 2025

Stated responseUndertook a review, working with third-party experts, to determine the nature and scope of the unauthorized access and confirm it was contained

ComplianceME AG ≤30d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov