DisclosureLens
UnknownRetail & ConsumerRetailCustomer Data InvolvedIdentity (basic)Government IDFinancial accountHighContained

Retail Merchandising Services

bd_a16a5123a81032b3 · schema v1 · pii pii-v1

Severity

High

Discovered

Feb 25, 2026

Filed

Mar 16, 2026

To disclose

19 days

Affected · nationwide

16,11454 in this filing

Linked

10 filings

Confidence

62%
Full breach record for Retail Merchandising Services →

Retail Merchandising Services reported a data breach occurring on November 24, 2025, discovered on February 25, 2026. The incident affected 16,114 individuals nationwide, including 54 Maine residents. The breach involved the unauthorized access of personal information, including names, government IDs, and financial account numbers. The company is offering 12 months of credit monitoring and identity theft protection services to affected individuals.

Maine clockDiscovered Feb 25, 2026 → Filed with AG Mar 16, 202619d ✓ ME AG ≤30d19 days discovery → filing
⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 93 days
discovery → filing · 19 days

Nov 24, 2025

Begins

Feb 25, 2026

Discovered

Mar 16, 2026

Filed

vs. sector median

5 wks faster

This filing is one of 10 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (9) · sorted by filing gap

Show 5 more filings ↓up to 15d gap

Filing propagation · 10 filings · 9 states

View merged incident ↗
Illinois State AGMar 1 · first
Nebraska State AG+15d
Massachusetts State AG+15d
Indiana State AG+15d
California State AG+15d
Vermont State AG+15d
New Hampshire State AG+15d
Indiana State AG+15d
Maine State AG+15d · this page
Texas State AG+16d

Pattern: first filing Mar 1 (IL), last Mar 17 (TX) — a 16-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.