HackingCustomer Data InvolvedGovernment IDHighContained

SUPERIOR PLUS US CAPITAL CORP.

bd_6f832ea42bdd7110 · schema v1 · pii pii-v1

Severity

High

Discovered

Dec 13, 2021

Filed

Mar 24, 2022

To disclose

14 weeks

Affected · nationwide

4,487389 in this filing

Linked

4 filings

Confidence

50%

Full breach record for SUPERIOR PLUS US CAPITAL CORP. →

Superior Plus Corp. experienced an external system breach (hacking) that occurred from December 11 to December 13, 2021, and was discovered on December 13, 2021. The breach affected 389 Maine residents, compromising their names in combination with their Driver's License or Non-Driver Identification Card Numbers. In response, the company provided affected individuals with 24 months of identity theft protection services, including credit and dark web monitoring, fraud assistance, and a $1,000,000 insurance reimbursement policy. Consumers were notified on March 25, 2022.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Dec 13, 2021 → Filed with AG Mar 24, 2022101d ✗ ME AG >90d14 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 2 days

discovery → filing · 14 weeks / 101 days

Dec 11, 2021

Begins

Dec 13, 2021

Discovered

Mar 24, 2022

Filed

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

New Hampshire State AGbd_2e383fc56d4fc7332022-03-24Verified
Massachusetts State AGbd_8b14334b1cba61292022-03-24Verified
Montana State AGbd_e198a7218882873d2022-03-25 · +1dCandidate

Name: SUPERIOR PLUS US CAPITAL CORP.
norm: superior plus us

Name: SUPERIOR PLUS US CAPITAL CORP.
norm: superior plus us

Discovered: Dec 13, 2021
Breach occurred: Dec 11, 2021 – Dec 13, 2021
Undetected for: 2 daysoccurrence → discovery
Materiality determined: —
Notification sent: Mar 25, 2022
Affected individuals: 4,487state + nationwide
Data types: Government ID
Data elements: Driver's licence number
Attack vector: Unauthorized Access
Threat actor: External

Changes made: The service provides impacted individuals with alerts for twenty-four months from the date of enrollment when changes occur to their credit file. Additionally, the services include dark web monitoring that will look out for their personal data on the dark web and alert them if their personally identifiable information is found online. Finally, we are providing them with proactive fraud assistance to help with any questions that they might have or in event that they become a victim of fraud, as well as a $1,000,000 insurance reimbursement policy.
Offered identity theft protection services
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 14 weeks(101 days from discovery to filing)
Compliance flags: ME AG >90d · 101dME resident >60d · 102d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Dec 13, 2021
→ Filed with AG: Mar 24, 2022
101d 90 days ME AG >90d
Maine
Discovered: Dec 13, 2021
→ Notified: Mar 25, 2022
102d 60 days (analyst band; statutory cap is 30 days) ME resident >60d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Dec 13, 2021 → Filed with AG: Mar 24, 2022	101d	90 days	ME AG >90d
Maine	Discovered: Dec 13, 2021 → Notified: Mar 25, 2022	102d	60 days (analyst band; statutory cap is 30 days)	ME resident >60d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

New Hampshire State AGMar 24 · first

Massachusetts State AGMar 24 · first

Maine State AGMar 24 · first · this page

Montana State AG+1d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/a3ab4748-8754-45b9-8d23-e464c5a66ac2.shtml
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 24, 2022
Raw hash: b1a2876ec43ff494b1b6c6c1321f58e8b26e9fcfef2b47e320440c2561b81a75

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entitySUPERIOR PLUS US CAPITAL CORP.

Victim entitySUPERIOR PLUS US CAPITAL CORP.

Incidentdiscovered Dec 13, 2021

ComplianceME AG >90d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov