HackingRetail & ConsumerRetailCustomer Data InvolvedIdentity (basic)MediumContained

Newk's Franchise Company, LLC

bd_96dfd619b72e5d7e · schema v1 · pii pii-v1

Severity

Medium

Discovered

Aug 27, 2025

Filed

Oct 28, 2025

To disclose

9 weeks

Affected · nationwide

2,6641 in this filing

Linked

4 filings

Confidence

65%

Newk's Holding Company, LLC (via Newk's Franchise Company, LLC) reported a cybersecurity incident in Maine affecting 2,664 individuals (1 Maine resident). Unauthorized access occurred between Jan 19-26, 2025, discovered Aug 27, 2025. Notification sent Oct 28, 2025. Data involved names and unspecified personal identifiers. Response included third-party investigation, system hardening, and 12 months of credit monitoring via Epiq.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Aug 27, 2025 → Filed with AG Oct 28, 202562d ⏱ ME AG >30d9 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 220 days

discovery → filing · 9 weeks / 62 days

Jan 19, 2025

Begins

Aug 27, 2025

Discovered

Oct 28, 2025

Filed

vs. sector median

1 wks faster

This filing is one of 4 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Indiana State AGbd_d4125809529866a92025-10-28Verified
Massachusetts State AGbd_b143387756feffe32025-10-29 · +1dVerified
Texas State AGbd_0832c29416cc22da2025-10-30 · +2dVerified

Name: Newk's Holding Company, LLC
norm: newk s

Name: Newk's Franchise Company, LLC
norm: newk's franchise
Also named: Newk's Holding Company, LLCoperating subsidiary ofholding company
Industry: Retail & Consumerllm

Discovered: Aug 27, 2025
Breach occurred: Jan 19, 2025 – Jan 26, 2025
Undetected for: 220 daysoccurrence → discovery
Materiality determined: —
Notification sent: Oct 28, 2025
Affected individuals: 2,664state + nationwide
Data types: Identity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: External
Initial access: exploit_public_facing

During the incident: Engaged third-party specialists to assist with understanding the nature and scope of the disruption
Secured systems and enhanced the security of the network
Arranged for complimentary credit monitoring and identity protection services for 12 months through Epiq
Changes made: Enhanced the security of the network to prevent similar incidents from occurring in the future
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 9 weeks(62 days from discovery to filing)
Compliance flags: ME AG >30d · 62d
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Aug 27, 2025
→ Filed with AG: Oct 28, 2025
62d 30 days (soft) ME AG >30d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Aug 27, 2025 → Filed with AG: Oct 28, 2025	62d	30 days (soft)	ME AG >30d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Indiana State AGOct 28 · first

Maine State AGOct 28 · first · this page

Massachusetts State AG+1d

Texas State AG+2d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/0142efaf-dee1-4f01-a32a-865b6a96afa3.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 28, 2025
Raw hash: 7869fc19be76ddfa11a6e423d2fe3655481be58f16bd82ac2a4c82aa8634b77e

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityNewk's Holding Company, LLC

Victim entityNewk's Franchise Company, LLC

Incidentdiscovered Aug 27, 2025

Stated responseEngaged third-party specialists to assist with understanding the nature and scope of the disruption

ComplianceME AG >30d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov