HackingTechnologyInformationTargetedData ExfiltratedIdentity (basic)MediumContained

Diligent Delivery Systems

bd_7fb5c0efe1f01c6a · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jul 11, 2024

Filed

Nov 5, 2024

To disclose

17 weeks

Affected · nationwide

10,54511 in this filing

Linked

7 records

Confidence

65%

Full breach record for Diligent Delivery Systems →

Diligent Delivery Systems experienced an external system breach (hacking) between July 8-9, 2024. The company discovered unusual activity on July 11, 2024, and determined on October 25, 2024, that personal information (names and other identifiers) of 10,545 individuals was accessed. Notices were sent on November 5, 2024, offering 12 months of credit monitoring and identity protection services.

J jump to incidentP pin to compareR raw source

Leak gap clock⏱ Leak >90d17 weeks discovery → filing

Incident timeline

undetected · 3 days

discovery → filing · 17 weeks / 117 days

Jul 8, 2024

Begins

Jul 11, 2024

Discovered

Nov 5, 2024

Filed

vs. sector median

+6 wks slower

This filing is one of 7 records about the same incident.View merged incident

A leak claim by embargo about this victim was first seen 117 days before this filing.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Siteembargobd_25eab650238a41622024-07-11 · +117dVerified by operator

Regulatory filings (5) · sorted by filing gap

Massachusetts State AGbd_1455692a25a6ff642024-11-05Verified by operator
Vermont State AGbd_5082cf82f4a727732024-11-05Verified
Indiana State AGbd_6507958dfc96f7582024-11-05Candidate
New Hampshire State AGbd_76352fa20710ca852024-11-05Verified

Show 1 more filing ↓

California State AGbd_dcb2167b11ac9df42024-11-05Verified

Name: Constangy, Brooks, Smith & Prophete, LLP
norm: constangy brooks smith prophete

Name: Diligent Delivery Systems
norm: diligent delivery
Domain: diligentusa.com
Industry: Technologyllm

Discovered: Jul 11, 2024
Scope identified: Oct 25, 2024Maine’s notice clock starts here (10 M.R.S. §1348(1))The letter says: “On or about October 25, 2024, Diligent learned that your personal information may have been impacted in connection with this incident.”
Breach occurred: Jul 8, 2024 – Jul 9, 2024
Undetected for: 3 daysoccurrence → discovery
Materiality determined: —
Notification sent: Nov 5, 2024
Affected individuals: 10,545state + nationwide
Data types: Identity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1078 Valid Accounts
Threat actor: External
Regulator citations: Filed notice with Maine Attorney General
Initial access: exploit_public_facing

During the incident: Engaged leading, independent cybersecurity experts to assist with an investigation
Took steps to secure its digital environment
Notified the Federal Bureau of Investigation
Changes made: Implemented additional security features to further bolster its security posture
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 17 weeks(117 days from discovery to filing)
Compliance flags: Leak >90dME AG ≤30d · 11d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Scope identified: Oct 25, 2024
→ Filed with AG: Nov 5, 2024
11d 30 days ME AG ≤30d

Statute	Window	Elapsed	Threshold	Status
Maine	Scope identified: Oct 25, 2024 → Filed with AG: Nov 5, 2024	11d	30 days	ME AG ≤30d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

Massachusetts State AGNov 5 · first

Vermont State AGNov 5 · first

Indiana State AGNov 5 · first

New Hampshire State AGNov 5 · first

California State AGNov 5 · first

Maine State AGNov 5 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/3a079161-79dc-4d25-b128-c403655876a1.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 5, 2024
Raw hash: f6b4a8573770cabe994fb8fdd8341e157e885b97f0f245ee5c46cc123e2f7a98

Linked disclosures

Ransomware claims (1)

Regulatory filings (5) · sorted by filing gap

Reporting entityConstangy, Brooks, Smith & Prophete, LLP

Victim entityDiligent Delivery Systems

Incidentdiscovered Jul 11, 2024

Stated responseEngaged leading, independent cybersecurity experts to assist with an investigation

ComplianceLeak >90d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov