HackingProfessional ServicesProfessional ServicesData ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDFinancial accountMediumContained

Windels Marx Lane & Mittendorf, LLP

bd_9d6be02d97811477 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Sep 11, 2025

Filed

Mar 30, 2026

To disclose

29 weeks

Affected

1state residents only

Linked

3 filings

Confidence

65%

Full breach record for Windels Marx Lane & Mittendorf, LLP →

Windels Marx Lane & Mittendorf, LLP reported an external system breach (hacking) on September 11, 2025, affecting one Maine resident. Unauthorized access resulted in the exfiltration of names, SSNs, and financial account information. The firm notified federal law enforcement, offered 12 months of TransUnion credit monitoring, and implemented additional security safeguards.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Sep 11, 2025 → Filed with AG Mar 30, 2026200d ⏱ ME AG >30d29 weeks discovery → filing

⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Incident timeline

discovery → filing · 29 weeks / 200 days

Sep 11, 2025

Begins

Sep 11, 2025

Discovered

Mar 30, 2026

Filed

vs. sector median

+9 wks slower

This filing is one of 3 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Indiana State AGbd_6822f0ae5a42ed422026-03-30Candidate
Indiana State AGbd_ca70dd4c08ce1fff2026-03-30Candidate

Name: Windels Marx Lane & Mittendorf, LLP
norm: windels marx lane mittendorf
Domain: windelsmarx.com
Industry: Legal Services

Name: Windels Marx Lane & Mittendorf, LLP
norm: windels marx lane mittendorf
Domain: windelsmarx.com
Industry: Legal Services
Industry: Professional Servicesllm

Discovered: Sep 11, 2025
Breach occurred: Sep 11, 2025
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Mar 30, 2026
Affected individuals: 1state-resident count only
Data types: Identity (basic)Government IDFinancial account
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Providing written notice of this incident to relevant state regulators
Initial access: exploit_public_facing

During the incident: Moved quickly to investigate and respond to the incident
Assessed the security of Windels systems
Identified potentially affected individuals
Notified federal law enforcement regarding the event
Provided access to credit monitoring services for twelve (12) months through TransUnion
Changes made: Implementing additional safeguards and training to its employees
Reviewing existing security policies
Implementing additional security measures to further protect against similar events occurring in the future
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 29 weeks(200 days from discovery to filing)
Compliance flags: ME AG >30d · 200dME resident >60d · 200d
Discovery-date grounding: occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Sep 11, 2025
→ Filed with AG: Mar 30, 2026
200d 30 days (soft) ME AG >30d
Maine
Discovered: Sep 11, 2025
→ Notified: Mar 30, 2026
200d 60 days (analyst band; statutory cap is 30 days) ME resident >60d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Sep 11, 2025 → Filed with AG: Mar 30, 2026	200d	30 days (soft)	ME AG >30d
Maine	Discovered: Sep 11, 2025 → Notified: Mar 30, 2026	200d	60 days (analyst band; statutory cap is 30 days)	ME resident >60d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 2 states

View merged incident ↗

Indiana State AGMar 30 · first

Maine State AGMar 30 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/8ca5fc3e-e74e-4639-a03d-2aefc53de38c.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 30, 2026
Raw hash: c0a63334fc4f3eb5b7d6a1dfef38b6abff2c157001a1b7680c7a295d568fc226

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityWindels Marx Lane & Mittendorf, LLP

Victim entityWindels Marx Lane & Mittendorf, LLP

Incidentdiscovered Sep 11, 2025

Stated responseMoved quickly to investigate and respond to the incident

ComplianceME AG >30d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov