HackingOtherData ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDCredentialsHealth (basic)MediumContained

Orchid Island Golf and Beach Club

bd_8884b2951577d400 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Aug 14, 2025

Filed

Sep 15, 2025

To disclose

5 weeks

Affected · nationwide

1311 in this filing

Linked

5 filings

Confidence

66%

Full breach record for Orchid Island Golf and Beach Club →

Orchid Island Golf and Beach Club reported an external system breach on August 14, 2025, affecting 131 individuals. Unauthorized access resulted in the exfiltration of names, SSNs, i-Enroller credentials, and health insurance info. The club engaged forensic specialists, notified law enforcement, and provided 12 months of TransUnion credit monitoring to affected individuals.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Aug 14, 2025 → Filed with AG Sep 15, 202532d ⏱ ME AG >30d5 weeks discovery → filing

⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Incident timeline

discovery → filing · 5 weeks / 32 days

Aug 14, 2025

Begins

Aug 14, 2025

Discovered

Sep 15, 2025

Filed

vs. sector median

4 wks faster

This filing is one of 5 about the same incident.View merged incident

A leak claim by akira about this victim predates this filing by 32 days.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (2)

Leak Siteakirabd_6b219add8df10e1a2025-11-19 · +65dVerified by operator
Leak Siteakirabd_2a405aca29b0a3042025-08-14 · +32dVerified by operator

Regulatory filings (2) · sorted by filing gap

Vermont State AGbd_40a24cd1ffdc8bec2025-09-15Verified
Massachusetts State AGbd_8f58589eb6071dc72025-09-16 · +1dVerified by operator

Name: Kennedys CMK LLP
norm: kennedys cmk

Name: Orchid Island Golf and Beach Club
norm: orchid island golf and beach club
Domain: orchidislandfl.com
Industry: Otherllm

Discovered: Aug 14, 2025
Breach occurred: Aug 14, 2025
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Sep 15, 2025
Affected individuals: 131state + nationwide
Data types: Identity (basic)Government IDCredentialsHealth (basic)
Data elements: Social Security number
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1078 Valid AccountsT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Reported to Maine Office of Attorney GeneralReporting to other state regulators as required
Initial access: exploit_public_facing

During the incident: Partnered with specialists in cyber incident responses to investigate the nature and scope of the event
Performed a thorough review of that data to identify what individuals and personal data were contained in the files
Provided written notice of the event to potentially impacted individuals
Offered twelve (12) months of credit monitoring and proactive fraud assistance services through TransUnion
Notified law enforcement
Changes made: Assessing its existing security safeguards and policies for ways it can remain diligent and increase its resilience against evolving threats
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 weeks(32 days from discovery to filing)
Compliance flags: ME AG >30d · 32dLeak >30d
Discovery-date grounding: occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Aug 14, 2025
→ Filed with AG: Sep 15, 2025
32d 30 days (soft) ME AG >30d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Aug 14, 2025 → Filed with AG: Sep 15, 2025	32d	30 days (soft)	ME AG >30d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Vermont State AGSep 15 · first

Maine State AGSep 15 · first · this page

Massachusetts State AG+1d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/8a8c7390-a39a-4253-b260-fc8c6a60fca7.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 15, 2025
Raw hash: e444998f8443c00c7521c4251b2d6d0b3f83972e13566ff1de42b70ade19928b

Linked disclosures

Ransomware claims (2)

Regulatory filings (2) · sorted by filing gap

Reporting entityKennedys CMK LLP

Victim entityOrchid Island Golf and Beach Club

Incidentdiscovered Aug 14, 2025

Stated responsePartnered with specialists in cyber incident responses to investigate the nature and scope of the event

ComplianceME AG >30d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov