HackingTechnologyInformationStolen CredentialsData ExfiltratedCustomer Data InvolvedPIIIdentity (basic)MediumContained

LCPtracker

bd_8fd5b2be60792c2f · schema v1 · pii pii-v1

Severity

Medium

Discovered

Aug 20, 2024

Filed

Nov 22, 2024

To disclose

13 weeks

Affected · nationwide

40,96316 in this filing

Linked

11 filings

Confidence

66%

Full breach record for LCPtracker →

LCPtracker, Inc. reported a data breach affecting 40,963 individuals. Unauthorized actors accessed and acquired files from LCPtracker's online storage environment between August 14 and August 20, 2024. The breach was discovered on August 20, 2024. Notices were sent on November 22, 2024, offering 12 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Aug 20, 2024 → Filed with AG Nov 22, 202494d ✗ ME AG >90d13 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 6 days

discovery → filing · 13 weeks / 94 days

Aug 14, 2024

Begins

Aug 20, 2024

Discovered

Nov 22, 2024

Filed

vs. sector median

5 wks faster

This filing is one of 11 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (10) · sorted by filing gap

Massachusetts State AGbd_0180907d27863f622024-11-22Verified
California State AGbd_07ceb60a4a6fe6c02024-11-22Candidate
New Hampshire State AGbd_0e244ae40a6462c92024-11-22Verified
Washington State AGbd_34557b06fe467f712024-11-22Verified

Show 6 more filings ↓up to 53d gap

Montana State AGbd_4726fd00272b61e62024-11-22Verified
Vermont State AGbd_520a0c887a11a2952024-11-22Verified
Indiana State AGbd_f0bef15520af331e2024-11-22Verified
Illinois State AGbd_f9f2519d3dbcab082024-11-01 · +21dVerified
California State AGbd_5fe6cef2935f0f9c2024-12-20 · +28dVerified
California State AGbd_4ac47077bd9ff2d32025-01-14 · +53dVerified

Name: LCPtracker
norm: lcptracker
Domain: prod-cdn.lcptracker.net

Name: LCPtracker
norm: lcptracker
Domain: prod-cdn.lcptracker.net
Industry: Technologyllm

Discovered: Aug 20, 2024
Breach occurred: Aug 14, 2024 – Aug 20, 2024
Undetected for: 6 daysoccurrence → discovery
Materiality determined: —
Notification sent: Nov 22, 2024
Affected individuals: 40,963state + nationwide
Data types: PIIIdentity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1119 Automated Collection
Threat actor: External
Regulator citations: Filed notification with Maine Attorney General
Initial access: valid_credentials

During the incident: Engaged a specialized third-party cybersecurity firm to conduct a comprehensive investigation
Conducted a comprehensive review of the impacted data
Notified affected individuals via written notice
Offered 12 months of complimentary credit monitoring and identity protection services through TransUnion
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 13 weeks(94 days from discovery to filing)
Compliance flags: ME AG >90d · 94d
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Aug 20, 2024
→ Filed with AG: Nov 22, 2024
94d 90 days ME AG >90d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Aug 20, 2024 → Filed with AG: Nov 22, 2024	94d	90 days	ME AG >90d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 11 filings · 9 states

View merged incident ↗

Illinois State AGNov 1 · first

Massachusetts State AG+21d

California State AG+21d

New Hampshire State AG+21d

Washington State AG+21d

Montana State AG+21d

Vermont State AG+21d

Indiana State AG+21d

Maine State AG+21d · this page

California State AG+49d

California State AG+74d

Pattern: first filing Nov 1 (IL), last Jan 14 (CA) — a 74-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/7843fb77-2108-4428-b491-00f9885e8e42.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 22, 2024
Raw hash: 28ed5c651e986246921422e86d94581bbf60c59796ffb58c333ed5df4fd33b2c

Linked disclosures

Regulatory filings (10) · sorted by filing gap

Reporting entityLCPtracker

Victim entityLCPtracker

Incidentdiscovered Aug 20, 2024

Stated responseEngaged a specialized third-party cybersecurity firm to conduct a comprehensive investigation

ComplianceME AG >90d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov