Social EngineeringProfessional ServicesProfessional ServicesPhishingStolen CredentialsCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDFinancial accountHighContained

Zenith American Solutions

bd_95957ef1c6dd1f31 · schema v1 · pii pii-v1

Severity

High

Discovered

—

Filed

Jan 29, 2025

To disclose

—

Affected

2,128state residents only

Linked

6 filings

Confidence

67%

Full breach record for Zenith American Solutions →5 incidents on file

Zenith American Solutions experienced a security breach on September 3, 2024, via a phishing attack that granted an unauthorized actor access to an employee's email inbox. The incident potentially affected 2,128 Maryland residents, exposing personal data including names, dates of birth, Social Security numbers, and financial/banking information. The company contained the incident, reviewed systems, retrained the affected employee, and instituted additional security safeguards. Affected individuals are being offered free credit monitoring and identity restoration services.

J jump to incidentP pin to compareR raw source

Incident timeline

Sep 3, 2024

Begins

Jan 29, 2025

Filed

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Vermont State AGbd_698b958ed454ee672025-01-29Verified
Maine State AGbd_0ea8fac64faf42cd2025-01-30 · +1dCandidate
Nebraska State AGbd_9d52fc12867ad6042025-01-30 · +1dVerified
Massachusetts State AGbd_2833e4d34faa5fea2025-02-04 · +6dVerified

Show 1 more filing ↓up to 58d gap

New Hampshire State AGbd_d0d193cfed6770e32025-03-28 · +58dVerified

Name: Zenith American Solutions
norm: zenith american
Domain: zenith-american.com

Name: Zenith American Solutions
norm: zenith american
Domain: zenith-american.com
Industry: Professional Servicesllm

Discovered: —
Breach occurred: Sep 3, 2024
Materiality determined: —
Notification sent: Jan 29, 2025
Affected individuals: 2,128state-resident count only
Data types: Identity (basic)Government IDFinancial account
Data elements: Social Security numberDate of birth
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid AccountsT1114 Email Collection
Threat actor: External
Regulator citations: Notified Maryland Attorney General
Initial access: phishing_link

During the incident: Performed a thorough review of our systems to ensure any risk related to this specific phishing event has been addressed
Instituted additional security safeguards to prevent re-occurrence
Responsible employee has taken additional re-training
Mailing breach notification letters
Offering Free Experian IdentityWorks credit monitoring and credit restoration services at no cost
Provided a toll-free line to assist with any questions
Changes made: Instituted additional security safeguards to prevent re-occurrence
Responsible employee has taken additional re-training
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

Vermont State AGJan 29 · first

Maryland State AGJan 29 · first · this page

Maine State AG+1d

Nebraska State AG+1d

Massachusetts State AG+6d

New Hampshire State AG+58d

Pattern: first filing Jan 29 (VT), last Mar 28 (NH) — a 58-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.maryland.gov/resources-info/SBN%20Documents/2025/ITU-376262.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 29, 2025
Raw hash: d58bf477e561e47267a955c8fd5867b9f9503cfb91a9d2f9f7d538bb21d8027e

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityZenith American Solutions

Victim entityZenith American Solutions

IncidentPhishing

Stated responsePerformed a thorough review of our systems to ensure any risk related to this specific phishing event has been addressed

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.maryland.gov