HackingStolen CredentialsData ExfiltratedCustomer Data InvolvedIDENTITY_BASICIDENTITY_GOVERNMENTFINANCIAL_ACCOUNTMediumContained
McLane Company, Inc.
bd_90d2bb2c7d05aa7d · schema v1 · pii pii-v1
Full breach record for McLane Company, Inc. →McLane Company, Inc. notified the Maryland Attorney General of a data event involving its eServe payroll platform. An unauthorized actor exploited a vulnerability to access accounts between October 12 and November 22, 2024, modifying direct deposit info. Nine Maryland residents were affected, with data including names, SSNs, DOBs, and bank account numbers. McLane engaged forensic specialists, provided 12 months of credit monitoring via TransUnion, and implemented additional security measures.
Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed9 affectedView incident
Source provenance
- Source URL
- https://oag.maryland.gov/resources-info/SBN%20Documents/2025/ITU-376142.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Nov 13, 2025
- Raw hash
- 646a6ec73a112a706fc38b49bddcff2f5b99b5db7822548826c463a2e65437f7
Reporting entity
- Name
- Mullen Coughlin LLCnorm: mullen coughlin
Victim entity
- Name
- McLane Company, Inc.norm: mclane
- Domain
- mclaneco.com
- Industry
- retail_consumer
Incident
- Discovered
- Nov 20, 2024
- Materiality determined
- —
- Notification sent
- Jan 9, 2025
- Affected individuals
- 9
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENTFINANCIAL_ACCOUNT
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1190 Exploit Public-Facing ApplicationT1078 Valid Accounts
- Threat actor
- ExternalFinancial
- Regulator citations
- provided written notice of this incident to relevant state regulators
- Initial access
- exploit_public_facing
Compliance
- Time to disclose
- 51 weeks(358 days from discovery to filing)
- Compliance flags
- — (clock not assessable for this source)
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.