HackingEducationProfessional ServicesEducationData ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDHighContained

Eckerd Youth Alternatives Inc.

bd_7dc713f4a40bbc70 · schema v1 · pii pii-v1

Severity

High

Discovered

Nov 11, 2024

Filed

Dec 17, 2025

To disclose

13 months

Affected · nationwide

68,58562 in this filing

Linked

8 filings

Confidence

66%

Full breach record for Eckerd Youth Alternatives Inc. →2 incidents on file

Eckerd Youth Alternatives Inc. dba Eckerd Connects reported an external system breach (hacking) occurring between Nov 3 and Nov 11, 2024. Unauthorized access affected 68,585 individuals, including 62 Maine residents. Personal information, including government identifiers, was potentially accessed. Notices were sent on Dec 17, 2025, offering 12 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Nov 11, 2024 → Filed with AG Dec 17, 2025401d ✗ ME AG >90d13 months discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 8 days

discovery → filing · 13 months / 401 days

Nov 3, 2024

Begins

Nov 11, 2024

Discovered

Dec 17, 2025

Filed

vs. sector median

+49 wks slower

This filing is one of 8 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (7) · sorted by filing gap

Nebraska State AGbd_98ce4c5508d08dfe2025-12-17Verified
Montana State AGbd_b158fa20470374f62025-12-17Verified
Indiana State AGbd_b53a7d0006e470652025-12-17Verified
Vermont State AGbd_b57072c5e297c8e52025-12-17Verified

Show 3 more filings ↓up to 5d gap

Massachusetts State AGbd_af0a88d7d51a02032025-12-18 · +1dVerified
Texas State AGbd_e809a14f277bed7c2025-12-19 · +2dVerified
New Hampshire State AGbd_1e47f996d8d211c62025-12-22 · +5dVerified

Name: Eckerd Youth Alternatives Inc.
norm: eckerd youth alternatives
Domain: eckerd.org

Name: Eckerd Youth Alternatives Inc.
norm: eckerd youth alternatives
Domain: eckerd.org
Also named: Eckerd Youth Alternatives Inc.dba oflegal entity
Eckerd Connectsdba oftrade name
Industry: EducationllmProfessional Servicesllm

Discovered: Nov 11, 2024
Breach occurred: Nov 3, 2024 – Nov 11, 2024
Undetected for: 8 daysoccurrence → discovery
Materiality determined: —
Notification sent: Dec 17, 2025
Affected individuals: 68,585state + nationwide
Data types: Identity (basic)Government ID
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1078 Valid Accounts
Threat actor: External
Initial access: exploit_public_facing

During the incident: Secured our network
Commenced a prompt and thorough investigation
Working very closely with external cybersecurity professionals
Offering 12 months of credit monitoring through Experian IdentityWorks
Changes made: Continually evaluates and modifies its practices and internal controls to enhance the security and privacy of your information
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 13 months(401 days from discovery to filing)
Compliance flags: ME AG >90d · 401dME resident >180d · 401d
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Nov 11, 2024
→ Filed with AG: Dec 17, 2025
401d 90 days ME AG >90d
Maine
Discovered: Nov 11, 2024
→ Notified: Dec 17, 2025
401d 180 days ME resident >180d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Nov 11, 2024 → Filed with AG: Dec 17, 2025	401d	90 days	ME AG >90d
Maine	Discovered: Nov 11, 2024 → Notified: Dec 17, 2025	401d	180 days	ME resident >180d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 8 filings · 8 states

View merged incident ↗

Nebraska State AGDec 17 · first

Montana State AGDec 17 · first

Indiana State AGDec 17 · first

Vermont State AGDec 17 · first

Maine State AGDec 17 · first · this page

Massachusetts State AG+1d

Texas State AG+2d

New Hampshire State AG+5d

Pattern: first filing Dec 17 (NE), last Dec 22 (NH) — a 5-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/3feda70c-fe80-491e-accf-4857d5d95918.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 17, 2025
Raw hash: 3f1783e25c37d28251500beb41d171f9f78752b42880b01465f2cc83a2feebc4

Linked disclosures

Regulatory filings (7) · sorted by filing gap

Reporting entityEckerd Youth Alternatives Inc.

Victim entityEckerd Youth Alternatives Inc.

Incidentdiscovered Nov 11, 2024

Stated responseSecured our network

ComplianceME AG >90d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov