HackingTechnologyInformationData ExfiltratedCustomer Data InvolvedGovernment IDIdentity (basic)CriticalContained

Convergent Outsourcing, Inc.

bd_7dfa3edfec606122 · schema v1 · pii pii-v1

Severity

Critical

Discovered

Jun 17, 2022

Filed

Nov 1, 2022

To disclose

20 weeks

Affected · nationwide

640,9061,296 in this filing

Linked

9 filings

Confidence

66%

Full breach record for Convergent Outsourcing, Inc. →2 incidents on file

Convergent Outsourcing, Inc. reported an external system breach (hacking) occurring on June 17, 2022. The incident affected 640,906 individuals, including 1,296 Maine residents. Acquired information included names and Social Security Numbers. Notification letters were sent on October 26, 2022, offering 12 months of identity theft protection services.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Jun 17, 2022 → Filed with AG Nov 1, 2022137d ✗ ME AG >90d20 weeks discovery → filing

⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Incident timeline

discovery → filing · 20 weeks / 137 days

Jun 17, 2022

Begins

Jun 17, 2022

Discovered

Nov 1, 2022

Filed

vs. sector median

+1 wks slower

This filing is one of 9 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (8) · sorted by filing gap

California State AGbd_408daf283b4aa0d62022-11-01Verified
New Hampshire State AGbd_68ececae1b10f25d2022-11-01Verified
Montana State AGbd_79fd3526dad02a412022-11-01Candidate
Washington State AGbd_406bbc06f61309b92022-11-02 · +1dVerified

Show 4 more filings ↓up to 8d gap

Oregon State AGbd_6d39e9e1f55b0f2f2022-11-02 · +1dVerified
Indiana State AGbd_3163ae493bc0fe592022-10-26 · +6dVerified
Delaware State AGbd_fd02da83dfcf08222022-10-26 · +6dVerified
South Carolina State AGbd_60daea53419856bc2022-11-09 · +8dVerified

Name: ICE MILLER LLP
norm: ice miller

Name: Convergent Outsourcing, Inc.
norm: convergent outsourcing
Industry: Technologyllm

Discovered: Jun 17, 2022
Breach occurred: Jun 17, 2022
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Oct 26, 2022
Affected individuals: 640,906state + nationwide
Data types: Government IDIdentity (basic)
Data elements: Social Security number
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: External
Initial access: exploit_public_facing

During the incident: Sent written notification to affected individuals
Offered 12 months of identity theft protection services
Changes made: Provided 12 months of single credit bureau monitoring
Provided cyberscan services
Provided identity theft insurance
Provided managed identity restoration
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 20 weeks(137 days from discovery to filing)
Compliance flags: ME AG >90d · 137dME resident >60d · 131dME CRA notice due
Discovery-date grounding: occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Jun 17, 2022
→ Filed with AG: Nov 1, 2022
137d 90 days ME AG >90d
Maine
Discovered: Jun 17, 2022
→ Notified: Oct 26, 2022
131d 60 days (analyst band; statutory cap is 30 days) ME resident >60d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Jun 17, 2022 → Filed with AG: Nov 1, 2022	137d	90 days	ME AG >90d
Maine	Discovered: Jun 17, 2022 → Notified: Oct 26, 2022	131d	60 days (analyst band; statutory cap is 30 days)	ME resident >60d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 9 filings · 9 states

View merged incident ↗

Indiana State AGOct 26 · first

Delaware State AGOct 26 · first

California State AG+6d

New Hampshire State AG+6d

Montana State AG+6d

Maine State AG+6d · this page

Washington State AG+7d

Oregon State AG+7d

South Carolina State AG+14d

Pattern: first filing Oct 26 (IN), last Nov 9 (SC) — a 14-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/b5be3a2c-d7bd-4b77-83da-d85b55f9dfe8.shtml
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 1, 2022
Raw hash: 9d9ecec24c1e9d7b1a8f7eb0ece85d4191707a8a2f4e8ddbc813d5910794e194

Linked disclosures

Regulatory filings (8) · sorted by filing gap

Reporting entityICE MILLER LLP

Victim entityConvergent Outsourcing, Inc.

Incidentdiscovered Jun 17, 2022

Stated responseSent written notification to affected individuals

ComplianceME AG >90d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov