AccidentalFinancial ServicesFinanceMisconfigurationCustomer Data InvolvedGovernment IDHighResolved

Ives Sultan & Spike CPAs

bd_729954edd6446243 · schema v1 · pii pii-v1

Severity

High

Discovered

Oct 1, 2020

Filed

Sep 16, 2021

To disclose

50 weeks

Affected · nationwide

5,7926 in this filing

Linked

6 filings

Confidence

50%

Full breach record for Ives Sultan & Spike CPAs →

On May 11, 2020, Ives Sultan & Spike CPAs experienced an internal system breach and an inadvertent disclosure of personal information. The breach was discovered in October 2020. The compromised information includes names and driver's license or non-driver identification card numbers. A total of 6 Maine residents were affected.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Oct 1, 2020 → Filed with AG Sep 16, 2021350d ✗ ME AG >90d50 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 143 days

discovery → filing · 50 weeks / 350 days

May 11, 2020

Begins

Oct 1, 2020

Discovered

Sep 16, 2021

Filed

vs. sector median

+42 wks slower

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Massachusetts State AGbd_19d163b0e065f5d12021-09-16Verified
Montana State AGbd_20bc1895c8eb3bb62021-09-16Candidate
Maine State AGbd_259fa8f74e26c8292021-09-16Verified by operator
Indiana State AGbd_bf0bfb916450d6642021-09-16Verified

Show 1 more filing ↓up to 5d gap

New Hampshire State AGbd_61d5dff879b01c6a2021-09-21 · +5dVerified

Name: Ives Sultan & Spike CPAs
norm: ives sultan spike cpas

Name: Ives Sultan & Spike CPAs
norm: ives sultan spike cpas
Industry: Financial Servicesllm

Discovered: Oct 1, 2020
Breach occurred: May 11, 2020
Undetected for: 143 daysoccurrence → discovery
Materiality determined: —
Notification sent: Sep 16, 2021
Affected individuals: 5,792state + nationwide
Data types: Government ID
Data elements: Driver's licence number
Attack vector: Misconfiguration

Changes made: Offered 12 months of free identity theft protection and credit monitoring services.
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 50 weeks(350 days from discovery to filing)
Compliance flags: ME AG >90d · 350dME resident >180d · 350d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Oct 1, 2020
→ Filed with AG: Sep 16, 2021
350d 90 days ME AG >90d
Maine
Discovered: Oct 1, 2020
→ Notified: Sep 16, 2021
350d 180 days ME resident >180d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Oct 1, 2020 → Filed with AG: Sep 16, 2021	350d	90 days	ME AG >90d
Maine	Discovered: Oct 1, 2020 → Notified: Sep 16, 2021	350d	180 days	ME resident >180d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 5 states

View merged incident ↗

Massachusetts State AGSep 16 · first

Montana State AGSep 16 · first

Maine State AGSep 16 · first

Indiana State AGSep 16 · first

Maine State AGSep 16 · first · this page

New Hampshire State AG+5d

Pattern: first filing Sep 16 (MA), last Sep 21 (NH) — a 5-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/8ef6237d-49e7-41ad-8c0a-cbba0b861bd4.shtml
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 16, 2021
Raw hash: 975270fb0f5bab400eab91b9a8c80ce747fc57685d18da44a10a750933d71908

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityIves Sultan & Spike CPAs

Victim entityIves Sultan & Spike CPAs

Incidentdiscovered Oct 1, 2020

Stated responseOffered 12 months of free identity theft protection and credit monitoring services.

ComplianceME AG >90d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov