HackingRetail & ConsumerRetailCustomer Data InvolvedTargetedIdentity (basic)Government IDHighContained

New Congol LLC

bd_920fd9583e362d9e · schema v1 · pii pii-v1

Severity

High

Discovered

Mar 24, 2026

Filed

May 8, 2026

To disclose

6 weeks

Affected · nationwide

4,8316 in this filing

Linked

5 filings

Confidence

65%

Full breach record for New Congol LLC →

New Congol LLC dba New Congoleum reported an external system breach (hacking) on March 24, 2026, affecting 4,831 individuals, including 6 Maine residents. Personal information compromised included names and Social Security numbers. The company engaged cybersecurity experts and offered 12 months of identity protection services through IDX. Notices were sent on May 8, 2026.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Mar 24, 2026 → Filed with AG May 8, 202645d ⏱ ME AG >30d6 weeks discovery → filing

⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Incident timeline

discovery → filing · 6 weeks / 45 days

Mar 24, 2026

Begins

Mar 24, 2026

Discovered

May 8, 2026

Filed

vs. sector median

1 wks faster

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Indiana State AGbd_560575999c0593682026-05-08Verified
Vermont State AGbd_f417c91380b20e212026-05-08Verified
New Hampshire State AGbd_87690ff170c130ee2026-05-11 · +3dVerified
Massachusetts State AGbd_ce07d35cca03480f2026-05-12 · +4dVerified

Name: Constangy, Brooks, Smith & Prophete, LLP
norm: constangy brooks smith prophete

Name: New Congol LLC
norm: new congol
Also named: New Congol LLCdba oflegal entity
New Congoleumdba oftrade name
Industry: Retail & Consumerllm

Discovered: Mar 24, 2026
Breach occurred: Mar 24, 2026
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: May 8, 2026
Affected individuals: 4,831state + nationwide
Data types: Identity (basic)Government ID
Data elements: Social Security number
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Filed data breach notice with Maine Attorney General
Initial access: exploit_public_facing

During the incident: Engaged independent cybersecurity experts to assist with the process of ensuring our network was secure and identifying whether any personal information was involved
Offering identity theft protection services through IDX
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 weeks(45 days from discovery to filing)
Compliance flags: ME AG >30d · 45d
Discovery-date grounding: occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Mar 24, 2026
→ Filed with AG: May 8, 2026
45d 30 days (soft) ME AG >30d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Mar 24, 2026 → Filed with AG: May 8, 2026	45d	30 days (soft)	ME AG >30d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Indiana State AGMay 8 · first

Vermont State AGMay 8 · first

Maine State AGMay 8 · first · this page

New Hampshire State AG+3d

Massachusetts State AG+4d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/c510df7a-5d42-4167-a426-d66d43815faf.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 8, 2026
Raw hash: df8464cfde2167e4a421b5bda8d917d9281b9c415668305c32c748ececc6552d

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityConstangy, Brooks, Smith & Prophete, LLP

Victim entityNew Congol LLC

Incidentdiscovered Mar 24, 2026

Stated responseEngaged independent cybersecurity experts to assist with the process of ensuring our network was secure and identifying whether any personal information was involved

ComplianceME AG >30d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov