HackingTechnologyInformationData ExfiltratedCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDFinancial accountEmploymentHealth (basic)MediumContained

JASCO Applied Sciences

bd_93f145d4bb389b85 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Oct 20, 2025

Filed

Nov 26, 2025

To disclose

5 weeks

Affected · nationwide

661 in this filing

Linked

5 filings

Confidence

66%

Full breach record for JASCO Applied Sciences →

JASCO Applied Sciences reported an external system breach (hacking) on July 21, 2025, discovered on October 20, 2025. The incident affected 66 individuals, including 1 Maine resident. Compromised data included names, SSNs, bank account numbers, driver's license numbers, and health card numbers belonging to current/former employees. JASCO contained the incident by taking systems offline and offered 24 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Oct 20, 2025 → Filed with AG Nov 26, 202537d ⏱ ME AG >30d5 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 91 days

discovery → filing · 5 weeks / 37 days

Jul 21, 2025

Begins

Oct 20, 2025

Discovered

Nov 26, 2025

Filed

vs. sector median

13 wks faster

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Ransomware claims (2)

Leak Siterhysidabd_4630416b295b25752025-10-07 · +50dVerified by operator
Leak Siterhysidabd_6498a0d8e5cf51742025-07-21 · +128dVerified by operator

Regulatory filings (2) · sorted by filing gap

New Hampshire State AGbd_2bbde01f657e74332025-11-26Verified
Massachusetts State AGbd_e75b9fbdbb4f2d692025-12-03 · +7dVerified

Name: JASCO Applied Sciences
norm: jasco applied sciences
Domain: jasco.com

Name: JASCO Applied Sciences
norm: jasco applied sciences
Domain: jasco.com
Industry: Technologyllm

Discovered: Oct 20, 2025
Breach occurred: Jul 21, 2025
Undetected for: 91 daysoccurrence → discovery
Materiality determined: —
Notification sent: Nov 25, 2025
Affected individuals: 66state + nationwide
Data types: Identity (basic)Government IDFinancial accountEmploymentHealth (basic)
Data elements: Social Security numberDate of birth
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1119 Automated Collection
Threat actor: ExternalFinancial
Regulator citations: Notifying applicable privacy regulatory authorities
Initial access: exploit_public_facing

During the incident: Temporarily taking systems offline
Implemented enhanced security measures
Consulting with experts to evaluate ways to further improve security safeguards
Notifying applicable privacy regulatory authorities
Offering 24 months of credit monitoring and identity theft protection through Equifax
Changes made: Implemented enhanced security measures to further protect network, systems, and data
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 weeks(37 days from discovery to filing)
Compliance flags: ME AG >30d · 37d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Oct 20, 2025
→ Filed with AG: Nov 26, 2025
37d 30 days (soft) ME AG >30d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Oct 20, 2025 → Filed with AG: Nov 26, 2025	37d	30 days (soft)	ME AG >30d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

New Hampshire State AGNov 26 · first

Maine State AGNov 26 · first · this page

Massachusetts State AG+7d

Pattern: first filing Nov 26 (NH), last Dec 3 (MA) — a 7-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/ef689f23-295d-483a-9e46-01d349345bf2.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 26, 2025
Raw hash: fa5accd7464b8a772a319f62cf07e99775fb5c1610e7284d2815efc913a7ae30

Linked disclosures

Ransomware claims (2)

Regulatory filings (2) · sorted by filing gap

Reporting entityJASCO Applied Sciences

Victim entityJASCO Applied Sciences

Incidentdiscovered Oct 20, 2025

Stated responseTemporarily taking systems offline

ComplianceME AG >30d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov