HackingFinancial ServicesFinanceCustomer Data InvolvedIdentity (basic)Government IDHighContained

Evolve Mortgage Services

bd_8375a654c8d54403 · schema v1 · pii pii-v1

Severity

High

Discovered

Mar 13, 2026

Filed

Mar 25, 2026

To disclose

12 days

Affected · nationwide

13,50125 in this filing

Linked

10 filings

Confidence

66%

Full breach record for Evolve Mortgage Services →

Evolve Mortgage Services, LLC reported an external system breach (hacking) occurring between September 17 and 24, 2025. The incident was discovered on March 13, 2026, affecting 13,501 individuals nationwide, including 25 Maine residents. Data types included names and government identifiers. Notices were sent starting February 25, 2026, offering 12 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Leak gap clock⏱ Leak >90d12 days discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 177 days

discovery → filing · 12 days

Sep 17, 2025

Begins

Mar 13, 2026

Discovered

Mar 25, 2026

Filed

vs. sector median

7 wks faster

This filing is one of 10 about the same incident.View merged incident

A leak claim by inc_ransom about this victim predates this filing by 145 days.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Siteinc_ransombd_fbf00eab4288c89d2025-10-30 · +146dCandidate

Regulatory filings (8) · sorted by filing gap

New Hampshire State AGbd_5f615dba869fb5382026-03-20 · +5dVerified
Maine State AGbd_0e0720d3d54d76bc2026-03-09 · +16dVerified
New Hampshire State AGbd_5b7f7e627b5875532026-02-04 · +49dCandidate
California State AGbd_ccdda7e983fcf53a2026-02-04 · +49dVerified by operator

Show 4 more filings ↓up to 107d gap

Massachusetts State AGbd_d63d1095e7ae97962026-02-04 · +49dVerified by operator
Nebraska State AGbd_df3cffe8e37016c12026-02-03 · +50dVerified
Nebraska State AGbd_e8533bc4021a9b4c2026-02-03 · +50dVerified
South Carolina State AGbd_6f9eeb071263f1fe2025-12-08 · +107dVerified

Name: Cipriani & Werner
norm: cipriani werner
Domain: c-wlaw.com

Name: Evolve Mortgage Services
norm: evolve mortgage
Domain: mrn3.com
Industry: Financial Servicesllm

Discovered: Mar 13, 2026
Breach occurred: Sep 17, 2025 – Sep 24, 2025
Undetected for: 177 daysoccurrence → discovery
Materiality determined: —
Notification sent: Feb 25, 2026
Affected individuals: 13,501state + nationwide
Data types: Identity (basic)Government ID
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: ExternalFinancial
Regulator citations: Filed notice with Maine Attorney General
Initial access: exploit_public_facing

During the incident: Provided 12 months of complimentary credit monitoring and identity protection services through TransUnion/Cyberscout
Sent written notification to affected individuals
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 12 days(12 days from discovery to filing)
Compliance flags: Leak >90d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 9 filings · 6 states

View merged incident ↗

South Carolina State AGDec 8 · first

Nebraska State AG+57d

New Hampshire State AG+58d

California State AG+58d

Massachusetts State AG+58d

Maine State AG+91d

New Hampshire State AG+102d

Maine State AG+107d · this page

Pattern: first filing Dec 8 (SC), last Mar 25 (ME) — a 107-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/94bdf4cb-f7ed-4616-9353-edcc5aa54927.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 25, 2026
Raw hash: dfae6fa5c726080320a46afadd2a136f8b2b7c15e701f3d6f41d606eaf08c7c1

Linked disclosures

Ransomware claims (1)

Regulatory filings (8) · sorted by filing gap

Reporting entityCipriani & Werner

Victim entityEvolve Mortgage Services

Incidentdiscovered Mar 13, 2026

Stated responseProvided 12 months of complimentary credit monitoring and identity protection services through TransUnion/Cyberscout

ComplianceLeak >90d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov