HackingData ExfiltratedCustomer Data InvolvedIDENTITY_BASICFINANCIAL_ACCOUNTHighContained
Wing Financial Services
bd_6dc3ef53bf4e5cba · schema v1 · pii pii-v1
Full breach record for Wing Financial Services →Wing Financial Services reported an external system breach (hacking) occurring between September 2020 and January 2022, discovered on August 9, 2022. The incident affected 240,772 individuals, including 2 Maine residents. Acquired data included names combined with financial account or credit/debit card numbers (with security codes/PINs). Wing provided 12 months of credit monitoring via Cyberscout and filed a notice with the Maine Attorney General.
Maine clockDiscovered Aug 9, 2022 → Filed with AG Dec 1, 2022114d ✗ ME AG >90d16 weeks discovery → filing
⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
This filing is one of 5 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (4) · sorted by filing gap
- bd_222b5057f3b0599eMontana State AGfiled 2022-12-01Candidate
- bd_dd0eab397cd0f931New Hampshire State AGfiled 2022-12-05(4d gap)Verified
- bd_97c60aad9fad22eeMaine State AGfiled 2022-12-30(29d gap)Verified
- bd_ea86ace32dbbea5dMaine State AGfiled 2023-03-15(104d gap)Verified
Source provenance
- Source URL
- https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/266008e2-e657-41cb-a258-40357b43c24b.shtml
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Dec 1, 2022
- Raw hash
- 4485c3e9bdcc2ed1fb8514054e75ca75c0df2e887ee87debd500df5c5a405ef4
Reporting entity
- Name
- Wing Financial Servicesnorm: wing financial
Victim entity
- Name
- Wing Financial Servicesnorm: wing financial
Incident
- Discovered
- Aug 9, 2022
- Materiality determined
- —
- Notification sent
- Dec 1, 2022
- Affected individuals
- 240,772
- Data types
- IDENTITY_BASICFINANCIAL_ACCOUNT
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1190 Exploit Public-Facing Application
- Threat actor
- ExternalFinancial
- Regulator citations
- Filed data breach notice with Maine Attorney General
- Initial access
- exploit_public_facing
Compliance
- Time to disclose
- 16 weeks(114 days from discovery to filing)
- Compliance flags
- ME AG >90d · 114dME resident >60d · 114d
- Discovery-date grounding
- unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
- Clock breakdown
Statute Window Elapsed Threshold Status Maine Discovered: Aug 9, 2022→ Filed with AG: Dec 1, 2022114d 90 days ME AG >90d Maine Discovered: Aug 9, 2022→ Notified: Dec 1, 2022114d 60 days (analyst band; statutory cap is 30 days) ME resident >60d
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.