HackingGovernmentGovernmentVulnerability ExploitCapture Stored DataData ExfiltratedTargetedCustomer Data InvolvedIdentity (basic)Government IDFinancial accountHealth (basic)CredentialsHighActive

City of Hayward, Minnesota

bd_999d64041fc82d93 · schema v1 · pii pii-v1

Severity

High

Discovered

Dec 30, 2024

Filed

Jan 31, 2025

To disclose

5 weeks

Affected · nationwide

32,4337 in this filing

Linked

9 filings

Confidence

66%

Full breach record for City of Hayward, Minnesota →

City of Hayward experienced an external system breach (hacking) on July 9, 2023, discovered on December 30, 2024. Approximately 32,433 individuals were impacted, including 7 Maine residents. Stolen data included names, SSNs, financial account details, medical records, and credentials. The FBI was notified, and credit monitoring was offered.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Dec 30, 2024 → Filed with AG Jan 31, 202532d ⏱ ME AG >30d5 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 540 days

discovery → filing · 5 weeks / 32 days

Jul 9, 2023

Begins

Dec 30, 2024

Discovered

Jan 31, 2025

Filed

This filing is one of 9 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (8) · sorted by filing gap

California State AGbd_07b9796ec86c247f2025-01-29 · +2dVerified
Indiana State AGbd_23584d2513e0424f2025-01-29 · +2dVerified
Maryland State AGbd_31b23c8ba48b22812025-01-29 · +2dVerified
Massachusetts State AGbd_48edcf84441f7ece2025-01-29 · +2dVerified

Show 4 more filings ↓up to 2d gap

Nebraska State AGbd_6fc43c6e9c18e0e02025-01-29 · +2dVerified
New Hampshire State AGbd_c85af40eea4341b42025-01-29 · +2dVerified
Vermont State AGbd_e6c7af17315c59532025-01-29 · +2dVerified
Montana State AGbd_ebf17f268801e42b2025-01-29 · +2dVerified

Name: City of Hayward, Minnesota
norm: city of hayward minnesota

Name: City of Hayward, Minnesota
norm: city of hayward minnesota
Industry: Governmentllm

Discovered: Dec 30, 2024
Breach occurred: Jul 9, 2023
Undetected for: 540 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jan 29, 2025
Affected individuals: 32,433state + nationwide
Data types: Identity (basic)Government IDFinancial accountHealth (basic)Credentials
Data elements: Social Security numberDate of birthMedical information
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 ChannelT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Filed notification with Maine Attorney General
Initial access: exploit_public_facing

During the incident: Engaged external cybersecurity professionals
Notified the FBI of the incident
Changes made: Reviewing existing policies and training protocols relating to data protection
Enhancing security measures and monitoring tools
Providing complimentary access to Experian IdentityWorks for 12 months
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 weeks(32 days from discovery to filing)
Compliance flags: ME AG >30d · 32d
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Dec 30, 2024
→ Filed with AG: Jan 31, 2025
32d 30 days (soft) ME AG >30d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Dec 30, 2024 → Filed with AG: Jan 31, 2025	32d	30 days (soft)	ME AG >30d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 9 filings · 9 states

View merged incident ↗

California State AGJan 29 · first

Indiana State AGJan 29 · first

Maryland State AGJan 29 · first

Massachusetts State AGJan 29 · first

Nebraska State AGJan 29 · first

New Hampshire State AGJan 29 · first

Vermont State AGJan 29 · first

Montana State AGJan 29 · first

Maine State AG+2d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/3cfa4ff5-ac9a-44d0-b104-36152fe1eb69.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 31, 2025
Raw hash: e00afbeec45ee92ea2c5d790c846efadec30b9b6a4e4eb50a95196f49df267f7

Linked disclosures

Regulatory filings (8) · sorted by filing gap

Reporting entityCity of Hayward, Minnesota

Victim entityCity of Hayward, Minnesota

Incidentdiscovered Dec 30, 2024

Stated responseEngaged external cybersecurity professionals

ComplianceME AG >30d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov