HackingRetail & ConsumerTransportation & LogisticsRetailStolen CredentialsEmail MisuseTargetedData ExfiltratedIdentity (basic)Government IDHighActive

DOT FOODS, INC.

bd_9789df32322e926b · schema v1 · pii pii-v1

Severity

High

Discovered

Dec 3, 2025

Filed

Jan 7, 2026

To disclose

5 weeks

Affected · nationwide

6,3741 in this filing

Linked

5 filings

Confidence

65%

Full breach record for DOT FOODS, INC. →

Dot Foods, Inc. and Dot Transportation, Inc. reported an external system breach (hacking) on December 3, 2025, where an unauthorized actor accessed a small number of email accounts between Dec 3-4, 2025. The incident potentially exposed employee names and Social Security Numbers. 6,374 individuals were affected, including 1 Maine resident. Notices were sent on January 7, 2026, offering 2 years of credit monitoring.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Dec 3, 2025 → Filed with AG Jan 7, 202635d ⏱ ME AG >30d5 weeks discovery → filing

⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Incident timeline

discovery → filing · 5 weeks / 35 days

Dec 3, 2025

Begins

Dec 3, 2025

Discovered

Jan 7, 2026

Filed

vs. sector median

3 wks faster

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Montana State AGbd_4b17fbb7cfac751f2026-01-07Verified by operator
Indiana State AGbd_cec278b5aed088e32026-01-07Verified
Nebraska State AGbd_d8b20ac4bfff479b2026-01-07Verified
Massachusetts State AGbd_231409942293f3922026-01-08 · +1dVerified

Name: DOT FOODS, INC.
norm: dot foods
Domain: dotfoods.com

Name: DOT FOODS, INC.
norm: dot foods
Domain: dotfoods.com
Industry: Retail & ConsumerllmTransportation & Logisticsllm

Discovered: Dec 3, 2025
Breach occurred: Dec 3, 2025 – Dec 4, 2025
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jan 7, 2026
Affected individuals: 6,374state + nationwide
Data types: Identity (basic)Government ID
Data elements: Social Security number
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1114 Email Collection
Threat actor: External
Regulator citations: Notified the Federal Bureau of Investigation
Initial access: valid_credentials

During the incident: Secured impacted email accounts
Engaged cybersecurity and computer forensics specialists
Notified the Federal Bureau of Investigation
Notified all employees via email
Provided access to credit monitoring services for two years through Norton LifeLock
Provided impacted individuals with guidance on how to better protect against identity theft and fraud
Changes made: Implementing additional safeguards and training to employees
Reviewed existing policies and procedures
Enhanced technical safeguards to reduce the likelihood of a similar future event
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 weeks(35 days from discovery to filing)
Compliance flags: ME AG >30d · 35d
Discovery-date grounding: occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Dec 3, 2025
→ Filed with AG: Jan 7, 2026
35d 30 days (soft) ME AG >30d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Dec 3, 2025 → Filed with AG: Jan 7, 2026	35d	30 days (soft)	ME AG >30d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Montana State AGJan 7 · first

Indiana State AGJan 7 · first

Nebraska State AGJan 7 · first

Maine State AGJan 7 · first · this page

Massachusetts State AG+1d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/892d86fd-c536-4205-beb9-001d40350ade.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 7, 2026
Raw hash: 4f9975ed4e46be65ca24280e503fd69fe82508b9000c8f9be9d9802d9aef0958

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityDOT FOODS, INC.

Victim entityDOT FOODS, INC.

Incidentdiscovered Dec 3, 2025

Stated responseSecured impacted email accounts

ComplianceME AG >30d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov