HackingFinancial ServicesFinanceCustomer Data InvolvedGovernment IDIdentity (basic)MediumContained

Cayan, LLC

bd_8cec46a434362ca6 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Nov 16, 2020

Filed

Feb 19, 2021

To disclose

14 weeks

Affected · nationwide

3031 in this filing

Linked

5 filings

Confidence

66%

Full breach record for Cayan, LLC →3 incidents on file

Cayan, LLC reported an external system breach (hacking) occurring between October 29, 2020, and November 18, 2020. The incident compromised the personal information of 303 individuals, including one Maine resident. The data acquired consisted of names and Social Security Numbers. Cayan notified affected individuals on February 19, 2021, and provided two years of complimentary credit monitoring and identity theft protection services through Equifax.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Nov 16, 2020 → Filed with AG Feb 19, 202195d ⏱ ME AG >30d14 weeks discovery → filing

Incident timeline

undetected · 18 days

discovery → filing · 14 weeks / 95 days

Oct 29, 2020

Begins

Nov 16, 2020

Discovered

Feb 19, 2021

Filed

vs. sector median

+5 wks slower

This filing is one of 5 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Montana State AGbd_60570ed7ac02e6e72021-04-22 · +62dVerified
Indiana State AGbd_d54bd9bb139fabb62021-04-22 · +62dVerified
Massachusetts State AGbd_fcc9ef38145573be2021-04-22 · +62dVerified
New Hampshire State AGbd_b433fc71f0d11dc02021-04-26 · +66dVerified

Name: Cayan, LLC
norm: cayan
Industry: Financial Services

Name: Cayan, LLC
norm: cayan
Industry: Financial Services
Industry: Financial Servicesllm

Discovered: Nov 16, 2020
Breach occurred: Oct 29, 2020 – Nov 18, 2020
Undetected for: 18 daysoccurrence → discovery
Materiality determined: —
Notification sent: Feb 19, 2021
Affected individuals: 303state + nationwide
Data types: Government IDIdentity (basic)
Data elements: Social Security number
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: External
Initial access: exploit_public_facing

During the incident: Provided credit monitoring and identity theft protection services for two years at no charge via Equifax
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 14 weeks(95 days from discovery to filing)
Compliance flags: ME AG >30d · 95d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Nov 16, 2020
→ Filed with AG: Feb 19, 2021
95d 30 days (soft) ME AG >30d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Nov 16, 2020 → Filed with AG: Feb 19, 2021	95d	30 days (soft)	ME AG >30d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Maine State AGFeb 19 · first · this page

Montana State AG+62d

Indiana State AG+62d

Massachusetts State AG+62d

New Hampshire State AG+66d

Pattern: first filing Feb 19 (ME), last Apr 26 (NH) — a 66-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/ccffdab3-0e76-410d-951b-437f9465dc8a.shtml
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 19, 2021
Raw hash: dbd29c7b2ad4b7f43e6ecce3c9f37a96b7c8d1c149bad531936c77bf5484e99d

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityCayan, LLC

Victim entityCayan, LLC

Incidentdiscovered Nov 16, 2020

Stated responseProvided credit monitoring and identity theft protection services for two years at no charge via Equifax

ComplianceME AG >30d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov