HackingGovernmentGovernmentStolen CredentialsCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)LowContained

Rhode Island Airport Corporation

bd_6f4d2e8b18754a6a · schema v1 · pii pii-v1

Severity

Low

Discovered

May 21, 2025

Filed

Jul 2, 2025

To disclose

6 weeks

Affected · nationwide

1511 in this filing

Linked

3 filings

Confidence

66%

Full breach record for Rhode Island Airport Corporation →2 incidents on file

Rhode Island Airport Corporation (RIAC) reported an external system breach (hacking) affecting employee email accounts. Unauthorized access occurred between May 14 and May 21, 2025. The incident impacted 151 individuals, including names and other personal identifiers. RIAC secured accounts, engaged forensic specialists, and notified affected individuals on July 1, 2025, offering 60 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered May 21, 2025 → Filed with AG Jul 2, 202542d ⏱ ME AG >30d6 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 7 days

discovery → filing · 6 weeks / 42 days

May 14, 2025

Begins

May 21, 2025

Discovered

Jul 2, 2025

Filed

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Vermont State AGbd_aea58ca54fc0d8b02025-11-26 · +147dVerified
New Hampshire State AGbd_7f84d9f81be271242025-12-01 · +152dVerified

Name: Hinckley, Allen & Snyder LLP
norm: hinckley allen snyder

Name: Rhode Island Airport Corporation
norm: rhode island airport
Industry: Governmentllm

Discovered: May 21, 2025
Breach occurred: May 14, 2025 – May 21, 2025
Undetected for: 7 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jul 1, 2025
Affected individuals: 151state + nationwide
Data types: Identity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1114 Email Collection
Threat actor: External
Regulator citations: Notified Maine Attorney General
Initial access: valid_credentials

During the incident: Took steps to secure RIAC’s employee email accounts
Retained nationally recognized cybersecurity specialists to conduct a comprehensive investigation
Remediated the security incident
Changes made: Enhance our existing security measures to reduce the risk of a future security incident
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 weeks(42 days from discovery to filing)
Compliance flags: ME AG >30d · 42d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: May 21, 2025
→ Filed with AG: Jul 2, 2025
42d 30 days (soft) ME AG >30d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: May 21, 2025 → Filed with AG: Jul 2, 2025	42d	30 days (soft)	ME AG >30d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Maine State AGJul 2 · first · this page

Vermont State AG+147d

New Hampshire State AG+152d

Pattern: first filing Jul 2 (ME), last Dec 1 (NH) — a 152-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/b40f92b2-f33d-480c-9ac1-965ea19617bf.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 2, 2025
Raw hash: ea16cb5c3010b063d30f4d5a68b4e4d0f54c899114f7922133011ff17de3881e

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityHinckley, Allen & Snyder LLP

Victim entityRhode Island Airport Corporation

Incidentdiscovered May 21, 2025

Stated responseTook steps to secure RIAC’s employee email accounts

ComplianceME AG >30d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov