HackingRetail & ConsumerRetailData ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDCriticalContained

WEL Companies

bd_6d99657c83c3ce72 · schema v1 · pii pii-v1

Severity

Critical

Discovered

Jan 31, 2025

Filed

Nov 19, 2025

To disclose

42 weeks

Affected · nationwide

122,960515 in this filing

Linked

14 filings

Confidence

65%

Full breach record for WEL Companies →

WEL Companies, Inc. reported an external system breach (hacking) occurring on January 30, 2025, discovered on January 31, 2025. The incident affected 122,960 individuals nationwide, including 515 Maine residents. Compromised data included names, Social Security numbers, and driver's license/state IDs. WEL engaged cybersecurity investigators, secured its network, and offered 12 months of credit monitoring via Kroll. Notices were sent on November 18, 2025.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Jan 31, 2025 → Filed with AG Nov 19, 2025292d ✗ ME AG >90d42 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 1 days

discovery → filing · 42 weeks / 292 days

Jan 30, 2025

Begins

Jan 31, 2025

Discovered

Nov 19, 2025

Filed

vs. sector median

+34 wks slower

This filing is one of 14 about the same incident.View merged incident

A leak claim by ransomhub about this victim predates this filing by 292 days.View originating leak claim

Linked disclosures

Why this link?

Regulatory filings (10) · sorted by filing gap

New Hampshire State AGbd_8ab1eb735d17368f2025-11-19Verified
Oregon State AGbd_9a34c0d3fcc432fa2025-11-19Verified
Washington State AGbd_b9a0483dfa133a9b2025-11-19Verified
California State AGbd_bfcb985961ca865a2025-11-19Verified

Show 6 more filings ↓up to 6d gap

South Carolina State AGbd_3282d3512f1a48132025-11-20 · +1dVerified
Montana State AGbd_0b06d74a7e1641a92025-11-18 · +1dVerified
Delaware State AGbd_54d6400fab04101c2025-11-18 · +1dVerified
Indiana State AGbd_8e16f85830814df82025-11-18 · +1dVerified
Massachusetts State AGbd_ff63c2c4b1fe49542025-11-21 · +2dVerified
Texas State AGbd_22f40843183648782025-11-25 · +6dVerified

Showing first 10 of 13 linked disclosures.

Name: Constangy, Brooks, Smith & Prophete, LLP
norm: constangy brooks smith prophete

Name: WEL Companies
norm: wel companies
Domain: welcompanies.com
Industry: Retail & Consumerllm

Discovered: Jan 31, 2025
Breach occurred: Jan 30, 2025
Undetected for: 1 dayoccurrence → discovery
Materiality determined: —
Notification sent: Nov 18, 2025
Affected individuals: 122,960state + nationwide
Data types: Identity (basic)Government ID
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Notified Maine Attorney General
Initial access: exploit_public_facing

During the incident: Took steps to secure its digital environment
Engaged a leading, independent, cybersecurity firm to conduct an investigation
Undertook a comprehensive review of those files
Verification of current mailing addresses for those individuals was then conducted
Offering you identity monitoring at no cost to you for 12 months through Kroll
Changes made: Implemented measures to enhance the security of its environment in an effort to minimize the risk of a similar incident occurring in the future
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 42 weeks(292 days from discovery to filing)
Compliance flags: ME AG >90d · 292dME resident >180d · 291dLeak >180d
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Jan 31, 2025
→ Filed with AG: Nov 19, 2025
292d 90 days ME AG >90d
Maine
Discovered: Jan 31, 2025
→ Notified: Nov 18, 2025
291d 180 days ME resident >180d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Jan 31, 2025 → Filed with AG: Nov 19, 2025	292d	90 days	ME AG >90d
Maine	Discovered: Jan 31, 2025 → Notified: Nov 18, 2025	291d	180 days	ME resident >180d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 11 filings · 11 states

View merged incident ↗

Montana State AGNov 18 · first

Delaware State AGNov 18 · first

Indiana State AGNov 18 · first

New Hampshire State AG+1d

Oregon State AG+1d

Washington State AG+1d

California State AG+1d

Maine State AG+1d · this page

South Carolina State AG+2d

Massachusetts State AG+3d

Texas State AG+7d

Pattern: first filing Nov 18 (MT), last Nov 25 (TX) — a 7-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Cascade drawn from the first 10 linked disclosures of 13 — the full spread may be wider.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/f88bb0ee-a9ad-47eb-92d8-7e0a47984cd6.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 19, 2025
Raw hash: e79dfaca40177f48da48309e8ddcedb7b1641e5810e11d7b4f0fd3b705383214

Linked disclosures

Regulatory filings (10) · sorted by filing gap

Reporting entityConstangy, Brooks, Smith & Prophete, LLP

Victim entityWEL Companies

Incidentdiscovered Jan 31, 2025

Stated responseTook steps to secure its digital environment

ComplianceME AG >90d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov