HackingHealthcareHealthcareData ExfiltratedCustomer Data InvolvedEmployee Data InvolvedDelayed DiscoveryIdentity (basic)Government IDCriticalContained

Central Maine healthcare

bd_9747493c948b644b · schema v1 · pii pii-v1

Severity

Critical

Discovered

Jun 1, 2025

Filed

Jan 12, 2026

To disclose

32 weeks

Affected · nationwide

145,381138,800 in this filing

Linked

2 filings

Confidence

66%

Full breach record for Central Maine healthcare →3 incidents on file

Central Maine Healthcare reported a data breach affecting 145,381 individuals, including 138,800 Maine residents. Unauthorized access occurred between March 19 and June 1, 2025, and was discovered on June 1, 2025. The incident involved the potential acquisition of names, Social Security numbers, and driver's license numbers. Notifications were sent starting August 8, 2025, offering credit monitoring services.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Jun 1, 2025 → Filed with AG Jan 12, 2026225d ✗ ME AG >90d32 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 74 days

discovery → filing · 32 weeks / 225 days

Mar 19, 2025

Begins

Jun 1, 2025

Discovered

Jan 12, 2026

Filed

vs. sector median

+20 wks slower

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Maine State AGbd_ce76379ac47238fe2026-01-15 · +3dCandidate

Name: Central Maine healthcare
norm: central maine healthcare

Name: Central Maine healthcare
norm: central maine healthcare
Industry: Healthcarellm

Discovered: Jun 1, 2025
Breach occurred: Mar 19, 2025 – Jun 1, 2025
Undetected for: 74 daysoccurrence → discovery
Materiality determined: —
Notification sent: Aug 8, 2025
Affected individuals: 145,381state + nationwide
Data types: Identity (basic)Government ID
Data elements: Social Security number
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Notified Maine Attorney General
Initial access: exploit_public_facing

During the incident: Notified law enforcement
Offering complimentary credit monitoring services
Established a dedicated, toll-free incident response line
Changes made: Implemented enhanced monitoring and alerting software
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 32 weeks(225 days from discovery to filing)
Compliance flags: ME AG >90d · 225dME resident >60d · 68dME CRA notice due
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Jun 1, 2025
→ Filed with AG: Jan 12, 2026
225d 90 days ME AG >90d
Maine
Discovered: Jun 1, 2025
→ Notified: Aug 8, 2025
68d 60 days (analyst band; statutory cap is 30 days) ME resident >60d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Jun 1, 2025 → Filed with AG: Jan 12, 2026	225d	90 days	ME AG >90d
Maine	Discovered: Jun 1, 2025 → Notified: Aug 8, 2025	68d	60 days (analyst band; statutory cap is 30 days)	ME resident >60d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings

View merged incident ↗

Maine State AGJan 12 · first · this page

Maine State AG+3d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/cec8f190-ecb3-40cb-9f37-d7f23f4ad7e9.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 12, 2026
Raw hash: d188404331617d03a7c6cc0bafe618f146089412fbb0e33259eb2575195c59f2

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityCentral Maine healthcare

Victim entityCentral Maine healthcare

Incidentdiscovered Jun 1, 2025

Stated responseNotified law enforcement

ComplianceME AG >90d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov