HackingProfessional ServicesProfessional ServicesData ExfiltratedCustomer Data InvolvedGovernment IDIdentity (basic)HighContained

Kimco Staffing Services Inc

bd_8db7a4c2493ba751 · schema v1 · pii pii-v1

Severity

High

Discovered

Nov 28, 2023

Filed

Dec 19, 2023

To disclose

21 days

Affected · nationwide

69,6871 in this filing

Linked

6 filings

Confidence

65%

Full breach record for Kimco Staffing Services Inc →

Kimco Staffing Services Inc. reported an external system breach (hacking) occurring on June 24, 2023, discovered on November 28, 2023. The incident compromised names and Social Security Numbers of 69,687 individuals, including 1 Maine resident. Kimco notified affected individuals in writing on December 19, 2023, and provided 12 months of credit monitoring and identity restoration services through Kroll.

J jump to incidentP pin to compareR raw source

Leak gap clock⏱ Leak >90d21 days discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 157 days

discovery → filing · 21 days

Jun 24, 2023

Begins

Nov 28, 2023

Discovered

Dec 19, 2023

Filed

vs. sector median

16 wks faster

This filing is one of 6 about the same incident.View merged incident

A leak claim by alphv about this victim predates this filing by 140 days.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Sitealphvbd_25e83c5caf9ca95c2023-08-01 · +140dVerified by operator

Regulatory filings (4) · sorted by filing gap

California State AGbd_4347f35c659302b72023-12-19Verified
Massachusetts State AGbd_6612009e2b4a69182023-12-19Verified by operator
Montana State AGbd_7b14c885d342aa562023-12-19Candidate
New Hampshire State AGbd_d9b6d152df31d6042023-12-19Verified

Name: Kimco Staffing Services Inc
norm: kimco staffing
Domain: kimco.com

Name: Kimco Staffing Services Inc
norm: kimco staffing
Domain: kimco.com
Industry: Professional Servicesllm

Discovered: Nov 28, 2023
Breach occurred: Jun 24, 2023
Undetected for: 157 daysoccurrence → discovery
Materiality determined: —
Notification sent: Dec 19, 2023
Affected individuals: 69,687state + nationwide
Data types: Government IDIdentity (basic)
Data elements: Social Security number
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: External
Initial access: exploit_public_facing

During the incident: Sent written notification to affected individuals
Offered 12 months of credit monitoring and identity restoration through Kroll
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 21 days(21 days from discovery to filing)
Compliance flags: Leak >90dME AG ≤30d · 21d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Nov 28, 2023
→ Filed with AG: Dec 19, 2023
21d 30 days ME AG ≤30d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Nov 28, 2023 → Filed with AG: Dec 19, 2023	21d	30 days	ME AG ≤30d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

California State AGDec 19 · first

Massachusetts State AGDec 19 · first

Montana State AGDec 19 · first

New Hampshire State AGDec 19 · first

Maine State AGDec 19 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/c4f1f009-9d69-4f48-866a-c34d1f11aa8f.shtml
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 19, 2023
Raw hash: 6bd59c38687dea4dd072180f133d07da2de1d419f44d43ec47d588832882176e

Linked disclosures

Ransomware claims (1)

Regulatory filings (4) · sorted by filing gap

Reporting entityKimco Staffing Services Inc

Victim entityKimco Staffing Services Inc

Incidentdiscovered Nov 28, 2023

Stated responseSent written notification to affected individuals

ComplianceLeak >90d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov