HackingSupply Chain (3P Vendor)Customer Data InvolvedData ExfiltratedIDENTITY_BASICIDENTITY_GOVERNMENTMediumActive
CALDWELL SUTTER CAPITAL, INC.
bd_92d7fd2ed3036b1b · schema v1 · pii pii-v1
Full breach record for CALDWELL SUTTER CAPITAL, INC. →Caldwell Sutter Capital, Inc. reported a data breach involving third-party vendor FoxTrot, LLC. Unauthorized access occurred on April 22, 2026, affecting 663 individuals, including 1 Maine resident. Compromised data included names, account numbers, and Social Security numbers. The incident is currently active, with notifications sent on May 29, 2026, offering 12 months of credit monitoring and identity restoration services.
Maine clockDiscovered Apr 29, 2026 → Filed with AG Jun 11, 202643d ⏱ ME AG >30d6 weeks discovery → filing
This filing is one of 4 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (3) · sorted by filing gap
- bd_37339e913805b8d7Vermont State AGfiled 2026-06-12(1d gap)Verified
- bd_dc8ad24a2c5902afMassachusetts State AGfiled 2026-06-01(10d gap)Verified
- bd_7fd3aefede554e9eIndiana State AGfiled 2026-05-29(13d gap)Verified
Source provenance
- Source URL
- https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/c9db290f-e077-4180-88fd-663e1a646a4a.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Jun 11, 2026
- Raw hash
- 7e08f0920a241add1b4f024f9c464dde6ec77e5f0a97cbcd02ac2b93814caa28
Reporting entity
- Name
- CALDWELL SUTTER CAPITAL, INC.norm: caldwell sutter
- Domain
- cald.com
Victim entity
- Name
- CALDWELL SUTTER CAPITAL, INC.norm: caldwell sutter
- Domain
- cald.com
Incident
- Discovered
- Apr 29, 2026
- Materiality determined
- —
- Notification sent
- May 29, 2026
- Affected individuals
- 663
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENT
- Attack vector
- Third-Party / Supply Chain
- MITRE ATT&CK
- T1195 Supply Chain Compromise
- Threat actor
- External
- Regulator citations
- Notified Maine Attorney GeneralEvaluating and making notifications to regulators and other authorities as required by applicable state and federal law
- Third party
- via FoxTrot, LLC
- Initial access
- supply_chain
Compliance
- Time to disclose
- 6 weeks(43 days from discovery to filing)
- Compliance flags
- ME AG >30d · 43d
- Discovery-date grounding
- letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
- Clock breakdown
Statute Window Elapsed Threshold Status Maine Discovered: Apr 29, 2026→ Filed with AG: Jun 11, 202643d 30 days (soft) ME AG >30d
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.