HackingRetail & ConsumerRetailTargetedData ExfiltratedIdentity (basic)Government IDMediumContained

Phoenix Footwear Group

bd_6ab9cd600bce653d · schema v1 · pii pii-v1

Severity

Medium

Discovered

Aug 26, 2024

Filed

Nov 6, 2024

To disclose

10 weeks

Affected · nationwide

17215 in this filing

Linked

2 filings

Confidence

65%

Full breach record for Phoenix Footwear Group →

Phoenix Footwear Group, Inc. disclosed an external system breach (hacking) on August 26, 2024, affecting 172 individuals, including 15 Maine residents. The incident involved unauthorized access to files containing names, Social Security numbers, and dates of birth. Phoenix notified federal law enforcement, secured its systems, and provided 12 months of credit monitoring through IDX to affected individuals.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Aug 26, 2024 → Filed with AG Nov 6, 202472d ⏱ ME AG >30d10 weeks discovery → filing

⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Incident timeline

discovery → filing · 10 weeks / 72 days

Aug 26, 2024

Begins

Aug 26, 2024

Discovered

Nov 6, 2024

Filed

vs. sector median

+3 wks slower

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Massachusetts State AGbd_71640cceeb2faf652024-11-06Verified

Name: Phoenix Footwear Group
norm: phoenix footwear
Domain: phxg.com
Industry: Retail/Consumer

Name: Phoenix Footwear Group
norm: phoenix footwear
Domain: phxg.com
Industry: Retail/Consumer
Industry: Retail & Consumerllm

Discovered: Aug 26, 2024
Breach occurred: Aug 26, 2024
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Nov 6, 2024
Affected individuals: 172state + nationwide
Data types: Identity (basic)Government ID
Data elements: Social Security numberDate of birth
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1119 Automated Collection
Threat actor: ExternalFinancial
Regulator citations: Notified federal law enforcement
Initial access: exploit_public_facing

During the incident: Moved quickly to investigate and respond to the incident
Secured its systems
Initiated an investigation into the nature and scope of the event
Undertook a thorough review of the affected data
Notified federal law enforcement regarding the event
Provided access to credit monitoring services for twelve (12) months through IDX
Changes made: Reviewing its policies and procedures
Assessing new cybersecurity tools to reduce the likelihood of similar future events
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 10 weeks(72 days from discovery to filing)
Compliance flags: ME AG >30d · 72d
Discovery-date grounding: occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Aug 26, 2024
→ Filed with AG: Nov 6, 2024
72d 30 days (soft) ME AG >30d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Aug 26, 2024 → Filed with AG: Nov 6, 2024	72d	30 days (soft)	ME AG >30d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Massachusetts State AGNov 6 · first

Maine State AGNov 6 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/94cea984-c437-4655-ab49-9d7a65d79980.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 6, 2024
Raw hash: ccce74d4f5d8a32ba15985444ca032ebc1f72e7e394c461bf4f1696c57c2ccda

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityPhoenix Footwear Group

Victim entityPhoenix Footwear Group

Incidentdiscovered Aug 26, 2024

Stated responseMoved quickly to investigate and respond to the incident

ComplianceME AG >30d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov