Sprague & Jackson
bd_7e07aad731fd91e9 · schema v1 · pii pii-v1
Full breach record for Sprague & Jackson →Sprague & Jackson, a tax and payroll processor, notified the Nebraska AG of a data security incident discovered on September 22, 2025. Unauthorized activity on its network potentially exposed the names, addresses, and SSNs/ITINs of 2 Nebraska residents. Notices were sent on May 21, 2026, offering 12 months of credit monitoring via TransUnion/Cyberscout. The company engaged forensic specialists and implemented enhanced security controls.
J jump to incidentP pin to compareR raw source
Incident timeline
Sep 22, 2025
Discovered
May 26, 2026
Filed
Linked disclosures
Why this link?Ransomware claims (1)
- Leak Siteqilinbd_0a2e9089ab17d00b2025-10-15 · +223dVerified by operator
Regulatory filings (5) · sorted by filing gap
- Indiana State AGbd_495e0dc3516989212026-05-26Verified by operator
- Maine State AGbd_561e93a40a8335c42026-05-26Verified by operator
- Vermont State AGbd_fb13980c6ccc84fd2026-05-26Verified by operator
- New Hampshire State AGbd_6753b906fd0020062026-06-01 · +6dVerified by operator
Show 1 more filing ↓Show fewer ↑up to 7d gap
- Massachusetts State AGbd_0608e24a308b2a762026-06-02 · +7dVerified by operator
Filing propagation · 6 filings · 6 states
View merged incident ↗Pattern: first filing May 26 (IN), last Jun 2 (MA) — a 7-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?
Evidence ladder
Attacker assertion only. Establishes: claim date, group, alleged victim.
Unlocks: incident narrative, operational impact. Still no compliance clock.
Unlocks: discovery date, data types, affected count, compliance clock.
Unlocks: materiality, stated response, full audit trail. Ceiling removed.