HackingFinancial ServicesFinanceStolen CredentialsCustomer Data InvolvedTargetedIdentity (basic)Government IDFinancial accountPHIHealth (basic)HighContained

ScrogginsGrear, Inc.

bd_86ba4d91bc3ec0ae · schema v1 · pii pii-v1

Severity

High

Discovered

Sep 10, 2025

Filed

Apr 15, 2026

To disclose

31 weeks

Affected · nationwide

8,9194 in this filing

Linked

5 filings

Confidence

65%

Full breach record for ScrogginsGrear, Inc. →

ScrogginsGrear, Inc., a financial services provider, reported a data breach affecting 8,919 individuals, including 4 Maine residents. Unauthorized access occurred on August 25, 2025, to a single employee email account. The breach exposed names, DOBs, driver's licenses, financial account numbers, health insurance numbers, and SSNs. Discovered on September 10, 2025, the company engaged Cyberscout for forensic assistance and offered 12 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Sep 10, 2025 → Filed with AG Apr 15, 2026217d ✗ ME AG >90d31 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 16 days

discovery → filing · 31 weeks / 217 days

Aug 25, 2025

Begins

Sep 10, 2025

Discovered

Apr 15, 2026

Filed

vs. sector median

+23 wks slower

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Massachusetts State AGbd_4c187f36983b80df2026-04-15Verified
Nebraska State AGbd_0c1cf6be1c26eba12026-04-07 · +8dVerified
Indiana State AGbd_a557065d807aa6812026-04-07 · +8dCandidate
Indiana State AGbd_c26fdefc73f53d552026-04-07 · +8dCandidate

Name: Wood Smith Henning & Berman LLP
norm: wood smith henning berman
Domain: wshblaw.com

Name: ScrogginsGrear, Inc.
norm: scrogginsgrear
Domain: scrogginsgrear.com
Industry: Financial Servicesllm

Discovered: Sep 10, 2025
Breach occurred: Aug 25, 2025
Undetected for: 16 daysoccurrence → discovery
Materiality determined: —
Notification sent: Apr 7, 2026
Affected individuals: 8,919state + nationwide
Data types: Identity (basic)Government IDFinancial accountPHIHealth (basic)
Data elements: Social Security numberDate of birth
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1114 Email Collection
Threat actor: ExternalFinancial
Regulator citations: Filed notice with Maine Attorney General
Initial access: valid_credentials

During the incident: Engaged the appropriate cybersecurity experts to assist
Providing you with access to Single Bureau Credit Monitoring/Single Bureau Credit Report/Single Bureau Credit Score services at no charge
Providing proactive fraud assistance
Changes made: Continuously reviewing policies and upgrading security measures
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 31 weeks(217 days from discovery to filing)
Compliance flags: ME AG >90d · 217dME resident >180d · 209d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Sep 10, 2025
→ Filed with AG: Apr 15, 2026
217d 90 days ME AG >90d
Maine
Discovered: Sep 10, 2025
→ Notified: Apr 7, 2026
209d 180 days ME resident >180d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Sep 10, 2025 → Filed with AG: Apr 15, 2026	217d	90 days	ME AG >90d
Maine	Discovered: Sep 10, 2025 → Notified: Apr 7, 2026	209d	180 days	ME resident >180d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 4 states

View merged incident ↗

Nebraska State AGApr 7 · first

Indiana State AGApr 7 · first

Massachusetts State AG+8d

Maine State AG+8d · this page

Pattern: first filing Apr 7 (NE), last Apr 15 (ME) — a 8-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/667bb5e7-b7f6-4a93-b09d-ad81bd5d6b5b.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 15, 2026
Raw hash: c913a23dbac0815d166ffef9b4aab9a3dfd8dfb6d091439106fabdfb246440f5

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityWood Smith Henning & Berman LLP

Victim entityScrogginsGrear, Inc.

Incidentdiscovered Sep 10, 2025

Stated responseEngaged the appropriate cybersecurity experts to assist

ComplianceME AG >90d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov