HackingTechnologyInformationData ExfiltratedTargetedIdentity (basic)Government IDFinancial accountHealth (basic)HighContained

The Gordian Group

bd_95e721a6a5b64827 · schema v1 · pii pii-v1

Severity

High

Discovered

Sep 3, 2024

Filed

Oct 1, 2024

To disclose

28 days

Affected · nationwide

1,4898 in this filing

Linked

2 filings

Confidence

66%

Full breach record for The Gordian Group →

The Gordian Group, Inc. reported an external system breach (hacking) occurring between January 25, 2023, and November 6, 2023. The incident compromised personal information of approximately 1,489 individuals, including 8 Maine residents. Data exposed included names, SSNs, driver's licenses, financial account numbers, and health insurance info. The breach was discovered on September 3, 2024, and notifications were sent on October 3, 2024. Affected individuals received 24 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Date basis clock✓ Clock withheld · confirmation date28 days discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 587 days

discovery → filing · 28 days

Jan 25, 2023

Begins

Sep 3, 2024

Discovered

Oct 1, 2024

Filed

vs. sector median

7 wks faster

This filing is one of 2 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

New Hampshire State AGbd_14b4d545a1151baa2024-10-03 · +2dVerified by operator

Name: The Gordian Group
norm: the gordian
Domain: gordian.com

Name: The Gordian Group
norm: the gordian
Domain: gordian.com
Industry: Technologyllm

Discovered: Sep 3, 2024
Breach occurred: Jan 25, 2023 – Nov 6, 2023
Undetected for: 587 daysoccurrence → discovery
Materiality determined: —
Notification sent: Oct 3, 2024
Affected individuals: 1,489state + nationwide
Data types: Identity (basic)Government IDFinancial accountHealth (basic)
Data elements: Social Security numberDate of birth
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1119 Automated CollectionT1074 Data Staged
Threat actor: ExternalFinancial
Regulator citations: Notified Office of the Attorney General of Maine
Initial access: exploit_public_facing

During the incident: Engaged leading external cybersecurity experts to assist in thoroughly investigating the incidents
Issued a precautionary notice about the incident
Offered complimentary credit monitoring to all current employees
Notified federal law enforcement authorities of the incidents
Enhanced security monitoring capabilities and technical controls
Changes made: Worked closely with forensic consultants to investigate, contain, and eradicate the incidents
Confirmed the security of our network environment
Enhanced security monitoring capabilities and technical controls to further protect the privacy of personal information in the future
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 28 days(28 days from discovery to filing)
Compliance flags: Clock withheld · confirmation date

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Maine State AGOct 1 · first · this page

New Hampshire State AG+2d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/59b07f8e-d46b-44ea-b76c-856f901efee6.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 1, 2024
Raw hash: f10d9ef6af72fd1c31313450cfe0e4439c1602ddff407e641a1efcd594be3770

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityThe Gordian Group

Victim entityThe Gordian Group

Incidentdiscovered Sep 3, 2024

Stated responseEngaged leading external cybersecurity experts to assist in thoroughly investigating the incidents

ComplianceClock withheld · confirmation date

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov