HackingVulnerability ExploitData ExfiltratedCustomer Data InvolvedIDENTITY_BASICFINANCIAL_ACCOUNTMediumContained
Squishable.com, Inc.
bd_6bd9ef85cda292c9 · schema v1 · pii pii-v1
Full breach record for Squishable.com, Inc. →Squishable.com, Inc. reported an external system breach (hacking) occurring on May 26, 2022, discovered on December 19, 2022. The incident compromised names and financial account/credit card numbers (with security codes/PINs) for 15,961 individuals, including 75 Maine residents. Written notification was sent on March 2, 2023. No identity theft protection services were offered.
Maine clockDiscovered Dec 19, 2022 → Filed with AG Mar 6, 202377d ⏱ ME AG >30d11 weeks discovery → filing
⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
This filing is one of 6 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (5) · sorted by filing gap
- bd_26dc2eee49c486e4Montana State AGfiled 2023-03-06Verified by operator
- bd_64f8fc08e15e855bNew Hampshire State AGfiled 2023-03-06Verified
- bd_c0b7238b2f2d673bCalifornia State AGfiled 2023-03-06Verified
- bd_067484bba6b3d128Washington State AGfiled 2023-03-02(4d gap)Candidate
Show 1 more filing ↓Show fewer ↑up to 4d gap
- bd_16ee5ba23e9a9e21Vermont State AGfiled 2023-03-02(4d gap)Verified
Source provenance
- Source URL
- https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/1bb4d312-a63b-420a-8a0f-ea122af88c69.shtml
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Mar 6, 2023
- Raw hash
- 8f519a84a811be1f2257f7e00763b50036a5c7c0677a96e40d9e5382595108d2
Reporting entity
- Name
- Squishable.com, Inc.norm: squishablecom
- Domain
- squishable.com
Victim entity
- Name
- Squishable.com, Inc.norm: squishablecom
- Domain
- squishable.com
Incident
- Discovered
- Dec 19, 2022
- Materiality determined
- —
- Notification sent
- Mar 2, 2023
- Affected individuals
- 15,961
- Data types
- IDENTITY_BASICFINANCIAL_ACCOUNT
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1190 Exploit Public-Facing Application
- Threat actor
- ExternalFinancial
- Regulator citations
- Filed data breach notice with Maine Attorney General
- Initial access
- exploit_public_facing
Compliance
- Time to disclose
- 11 weeks(77 days from discovery to filing)
- Compliance flags
- ME AG >30d · 77dME resident >60d · 73d
- Discovery-date grounding
- unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
- Clock breakdown
Statute Window Elapsed Threshold Status Maine Discovered: Dec 19, 2022→ Filed with AG: Mar 6, 202377d 30 days (soft) ME AG >30d Maine Discovered: Dec 19, 2022→ Notified: Mar 2, 202373d 60 days (analyst band; statutory cap is 30 days) ME resident >60d
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.