HackingFinancial ServicesFinanceStolen CredentialsData ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDCriticalContained

HIGHTOWER HOLDING, LLC

bd_88f8377542b02145 · schema v1 · pii pii-v1

Severity

Critical

Discovered

Jan 9, 2026

Filed

Mar 23, 2026

To disclose

10 weeks

Affected · nationwide

131,4831,557 in this filing

Linked

9 filings

Confidence

65%

Full breach record for HIGHTOWER HOLDING, LLC →

Hightower Holding, LLC reported a data breach affecting 131,483 individuals, including 1,557 Maine residents. Unauthorized access occurred between Jan 8-9, 2026, via compromised user credentials. Exposed data included names, SSNs, and driver's licenses. The company engaged forensic specialists, notified law enforcement, and provided 12 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Jan 9, 2026 → Filed with AG Mar 23, 202673d ⏱ ME AG >30d10 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 1 days

discovery → filing · 10 weeks / 73 days

Jan 8, 2026

Begins

Jan 9, 2026

Discovered

Mar 23, 2026

Filed

vs. sector median

+2 wks slower

This filing is one of 9 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (8) · sorted by filing gap

Vermont State AGbd_11c694a16108e78e2026-03-23Verified
Washington State AGbd_618ac39ae73afd622026-03-23Candidate
New Hampshire State AGbd_63d000b1f7a591922026-03-23Verified
Indiana State AGbd_79f3f287285213732026-03-23Verified

Show 4 more filings ↓up to 22d gap

Maine State AGbd_9ab4cb833accec1b2026-03-24 · +1dVerified
Massachusetts State AGbd_cc7ac8b88135f6ba2026-03-24 · +1dVerified
Texas State AGbd_6ed226a1f4fa64d62026-03-25 · +2dVerified
Illinois State AGbd_b618d47c063c96c42026-03-01 · +22dVerified

Name: HIGHTOWER HOLDING, LLC
norm: hightower holding
Domain: hightoweradvisors.com
Industry: Financial Services

Name: HIGHTOWER HOLDING, LLC
norm: hightower holding
Domain: hightoweradvisors.com
Industry: Financial Services
Industry: Financial Servicesllm

Discovered: Jan 9, 2026
Breach occurred: Jan 8, 2026 – Jan 9, 2026
Undetected for: 1 dayoccurrence → discovery
Materiality determined: —
Notification sent: Mar 23, 2026
Affected individuals: 131,483state + nationwide
Data types: Identity (basic)Government ID
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Provided written notice to relevant state regulatorsNotified the three major credit reporting agencies, Equifax, Experian, and TransUnion
Initial access: valid_credentials

During the incident: Promptly took steps to secure its network
Initiated a comprehensive investigation with the assistance of third-party cybersecurity and digital forensic specialists
Engaged third-party data review specialists to conduct a thorough review of the files
Notified federal law enforcement regarding the event
Provided access to credit monitoring and identity theft protection services for twelve (12) months through TransUnion
Changes made: Undertook additional measures to further strengthen its cybersecurity posture even with respect to credentialed users
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 10 weeks(73 days from discovery to filing)
Compliance flags: ME AG >30d · 73dME CRA notice due
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Jan 9, 2026
→ Filed with AG: Mar 23, 2026
73d 30 days (soft) ME AG >30d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Jan 9, 2026 → Filed with AG: Mar 23, 2026	73d	30 days (soft)	ME AG >30d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 9 filings · 8 states

View merged incident ↗

Illinois State AGMar 1 · first

Vermont State AG+22d

Washington State AG+22d

New Hampshire State AG+22d

Indiana State AG+22d

Maine State AG+22d · this page

Maine State AG+23d

Massachusetts State AG+23d

Texas State AG+24d

Pattern: first filing Mar 1 (IL), last Mar 25 (TX) — a 24-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/4279500a-59cc-4b07-bbc3-62ed0322bcc5.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 23, 2026
Raw hash: 5b7056297a0190f922c76fb4becc12c76069a000aff231245e37d98cfb747e92

Linked disclosures

Regulatory filings (8) · sorted by filing gap

Reporting entityHIGHTOWER HOLDING, LLC

Victim entityHIGHTOWER HOLDING, LLC

Incidentdiscovered Jan 9, 2026

Stated responsePromptly took steps to secure its network

ComplianceME AG >30d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov