DisclosureLens
HackingFinancial ServicesFinanceCustomer Data InvolvedFinancial accountFinancial credentialsHighContained

Wing Financial Services

bd_97c60aad9fad22ee · schema v1 · pii pii-v1

Severity

High

Discovered

Aug 9, 2022

Filed

Dec 30, 2022

To disclose

20 weeks

Affected · nationwide

243,4032 in this filing

Linked

7 filings

Confidence

50%
Full breach record for Wing Financial Services →

Wing Financial Services reported a data breach to the Maine Attorney General, indicating that an external system hacking incident occurred over a prolonged period from September 2020 to January 2022. The breach was discovered on August 9, 2022. The compromised information includes names and financial account numbers or credit/debit card numbers with their access codes. While the breach affected 243,403 individuals in total, only 2 Maine residents were impacted. Affected individuals were notified on December 1, 2022, and offered 12 months of credit monitoring and identity theft protection services through Cyberscout.

Maine clockDiscovered Aug 9, 2022 → Filed with AG Dec 30, 2022143d ⏱ ME AG >30d20 weeks discovery → filing
⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 707 days
discovery → filing · 20 weeks / 143 days

Sep 1, 2020

Begins

Aug 9, 2022

Discovered

Dec 30, 2022

Filed

vs. sector median

+12 wks slower

This filing is one of 7 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (6) · sorted by filing gap

Show 2 more filings ↓up to 75d gap

Filing propagation · 7 filings · 5 states

View merged incident ↗
Montana State AGDec 1 · first
Maine State AGDec 1 · first
Indiana State AGDec 1 · first
New Hampshire State AG+4d
Massachusetts State AG+8d
Maine State AG+29d · this page
Maine State AG+104d

Pattern: first filing Dec 1 (MT), last Mar 15 (ME) — a 104-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.