HackingRetail & ConsumerRetailAuto Parts RetailCustomer Data InvolvedIdentity (basic)Government IDCriticalResolved

MarineMax, Inc.

bd_a019d7e057c3ca54 · schema v1 · pii pii-v1

Severity

Critical

Discovered

Mar 10, 2024

Filed

Jul 16, 2024

To disclose

18 weeks

Affected · nationwide

123,494153 in this filing

Linked

12 records

Confidence

65%

Full breach record for MarineMax, Inc. →

MarineMax, Inc. reported an external system breach (hacking) on March 10, 2024, affecting 123,494 individuals, including 153 Maine residents. The breach involved the acquisition of personal identifiers. MarineMax notified affected individuals on July 16, 2024, and provided 24 months of identity theft protection services through Experian.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Mar 10, 2024 → Filed with AG Jul 16, 2024128d ⏱ ME AG >30d18 weeks discovery → filing

⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Incident timeline

discovery → filing · 18 weeks / 128 days

Mar 10, 2024

Begins

Mar 10, 2024

Discovered

Jul 16, 2024

Filed

vs. sector median

+9 wks slower

This filing is one of 12 records about the same incident.View merged incident

A leak claim by rhysida about this victim was first seen 118 days before this filing.View originating leak claim

Linked disclosures

Why this link?

Regulatory filings (9) · sorted by filing gap

Indiana State AGbd_0f878f76066c5f222024-07-16Verified by operator
Massachusetts State AGbd_1172f515803033fd2024-07-16Verified by operator
South Carolina State AGbd_1e2d33b188b249382024-07-16Verified
New Hampshire State AGbd_29639741801d07d32024-07-16Verified by operator

Show 5 more filings ↓up to 126d gap

Vermont State AGbd_8fa0e6de8ec422e12024-07-16Verified by operator
California State AGbd_f6e3aae64c5b56982024-07-16Verified by operator
Montana State AGbd_fb1d2c8bf0d356b12024-07-16Verified by operator
SEC 8-Kbd_f40953669866c89c2024-04-01 · +106dVerified
SEC 8-Kbd_8a1ed142962d25ff2024-03-12 · +126dVerified

Press reports (1)

Pressrhysidabd_23b6b8daee8338b22024-03-10 · +128dCandidate

Showing first 10 of 11 linked disclosures.

Name: MarineMax, Inc.
norm: marinemax
Domain: marinemax.com

Name: MarineMax, Inc.
norm: marinemax
Domain: marinemax.com
Industry: Retail & Consumerllm
NAICS 441330 · Automotive Parts and Accessories Retailers

Discovered: Mar 10, 2024
Breach occurred: Mar 10, 2024
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jul 16, 2024
Affected individuals: 123,494state + nationwide
Data types: Identity (basic)Government ID
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: ExternalFinancial
Initial access: exploit_public_facing

During the incident: Offered 24 Months of identity theft protection services through Experian
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 18 weeks(128 days from discovery to filing)
Compliance flags: ME AG >30d · 128dLeak >90d
Discovery-date grounding: occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Mar 10, 2024
→ Filed with AG: Jul 16, 2024
128d 30 days (soft) ME AG >30d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Mar 10, 2024 → Filed with AG: Jul 16, 2024	128d	30 days (soft)	ME AG >30d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 10 filings · 8 states

View merged incident ↗

SEC 8-KMar 12 · first

SEC 8-K+20d

Indiana State AG+126d

Massachusetts State AG+126d

South Carolina State AG+126d

New Hampshire State AG+126d

Vermont State AG+126d

California State AG+126d

Montana State AG+126d

Maine State AG+126d · this page

Pattern: first filing Mar 12, last Jul 16 (ME) — a 126-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Cascade drawn from the first 10 linked disclosures of 11 — the full spread may be wider.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/07822acb-6bb3-4bf8-8ea6-9a7b98f106c0.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 16, 2024
Raw hash: 8a375b12d06a0a24559a7811a9aaba856896ac31d05cbb6b72eec2c204daa66c

Linked disclosures

Regulatory filings (9) · sorted by filing gap

Press reports (1)

Reporting entityMarineMax, Inc.

Victim entityMarineMax, Inc.

Incidentdiscovered Mar 10, 2024

Stated responseOffered 24 Months of identity theft protection services through Experian

ComplianceME AG >30d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov