HackingRetail & ConsumerRetailSkimmerTargetedCustomer Data InvolvedFinancial accountIdentity (basic)MediumContained

Professional Development Resources

bd_951eb68b1963803f · schema v1 · pii pii-v1

Severity

Medium

Discovered

Aug 9, 2024

Filed

Sep 4, 2024

To disclose

26 days

Affected · nationwide

4,99721 in this filing

Linked

4 filings

Confidence

66%

Full breach record for Professional Development Resources →

Professional Development Resources, Inc. reported an external system breach involving a digital skimmer installed on its checkout page. The incident, discovered on August 9, 2024, affected 4,997 individuals nationwide, including 21 Maine residents. Compromised data included billing and credit card information. The company engaged a cybersecurity firm and notified the FBI and state AGs.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Aug 9, 2024 → Filed with AG Sep 4, 202426d ✓ ME AG ≤30d26 days discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 221 days

discovery → filing · 26 days

Jan 1, 2024

Begins

Aug 9, 2024

Discovered

Sep 4, 2024

Filed

vs. sector median

4 wks faster

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Massachusetts State AGbd_94a36ae8eb5b439b2024-09-04Verified
New Hampshire State AGbd_4fd95f13b482a6a12024-09-06 · +2dVerified
Indiana State AGbd_6af07e57abca12442024-08-29 · +6dVerified

Name: Professional Development Resources
norm: professional development resources
Domain: pdresources.org

Name: Professional Development Resources
norm: professional development resources
Domain: pdresources.org
Industry: Retail & Consumerllm

Discovered: Aug 9, 2024
Breach occurred: Jan 1, 2024
Undetected for: 221 daysoccurrence → discovery
Materiality determined: —
Notification sent: Aug 29, 2024
Affected individuals: 4,997state + nationwide
Data types: Financial accountIdentity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1530 Data from Cloud Storage ObjectT1052 Exfiltration Over Physical Medium
Threat actor: ExternalFinancial
Regulator citations: Notified the FBINotified state Attorney Generals
Initial access: exploit_public_facing

During the incident: Engaged a leading cybersecurity firm to assist in our investigation and to enhance our security measures
Notified the FBI, state Attorney Generals, and consumer reporting agencies
Changes made: Took steps to secure our systems and prevent further unauthorized access
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 26 days(26 days from discovery to filing)
Compliance flags: ME AG ≤30d · 26d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Aug 9, 2024
→ Filed with AG: Sep 4, 2024
26d 30 days ME AG ≤30d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Aug 9, 2024 → Filed with AG: Sep 4, 2024	26d	30 days	ME AG ≤30d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Indiana State AGAug 29 · first

Massachusetts State AG+6d

Maine State AG+6d · this page

New Hampshire State AG+8d

Pattern: first filing Aug 29 (IN), last Sep 6 (NH) — a 8-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/71cf083f-a7df-4f9f-892f-f552792cd051.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 4, 2024
Raw hash: 8892650c38ada1496b89c57b0c5dbd8264f9c373a15182f6eb5279c39e14c219

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityProfessional Development Resources

Victim entityProfessional Development Resources

Incidentdiscovered Aug 9, 2024

Stated responseEngaged a leading cybersecurity firm to assist in our investigation and to enhance our security measures

ComplianceME AG ≤30d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov