HackingRetail & ConsumerRetailVulnerability ExploitCapture App DataData ExfiltratedCustomer Data InvolvedDelayed DiscoveryPIIPCILowContained
American Soccer Company Inc.
bd_a375339e8672f00f · schema v1 · pii pii-v1
Full breach record for American Soccer Company Inc. →Score Sports (American Soccer Company Inc.) experienced unauthorized access to their e-commerce website between April 14, 2025 and August 19, 2025. Suspicious activity was discovered on August 7, 2025. The breach exposed customer names and payment card information. A total of 8,430 individuals were affected, including 62 Maine residents. Notifications were sent November 18, 2025. Twelve months of complimentary credit monitoring via TransUnion/Cyberscout was offered.
Maine clockDiscovered Aug 7, 2025 → Filed with AG Nov 18, 2025103d ✗ ME AG >90d15 weeks discovery → filing
⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
This filing is one of 3 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (2) · sorted by filing gap
- bd_e7d8908206fd9ff1Indiana State AGfiled 2025-11-18Verified
- bd_5838d995bad6fd61Texas State AGfiled 2025-11-19(1d gap)Verified
Source provenance
- Source URL
- https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/74643376-801c-4e4e-978c-dc527a4b4901.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Nov 18, 2025
- Raw hash
- 6a637a439a6c0c509ee0c7d0c60e589ea24ab39a98591da09f48c3b80c093d23
Reporting entity
- Name
- American Soccer Company Inc.norm: american soccer
- Domain
- scoresports.com
- Industry
- Other Commercial
Victim entity
- Name
- American Soccer Company Inc.norm: american soccer
- Domain
- scoresports.com
- Industry
- Other Commercial
- Industry
- Retail & Consumerllm
Incident
- Discovered
- Aug 7, 2025
- Materiality determined
- —
- Notification sent
- Nov 18, 2025
- Affected individuals
- 62
- Data types
- PIIPCI
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1190 Exploit Public-Facing ApplicationT1005 Data from Local System
- Threat actor
- ExternalFinancial
- Initial access
- exploit_public_facing
Compliance
- Time to disclose
- 15 weeks(103 days from discovery to filing)
- Compliance flags
- ME AG >90d · 103dME resident >60d · 103d
- Discovery-date grounding
- unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
- Clock breakdown
Statute Window Elapsed Threshold Status Maine Discovered: Aug 7, 2025→ Filed with AG: Nov 18, 2025103d 90 days ME AG >90d Maine Discovered: Aug 7, 2025→ Notified: Nov 18, 2025103d 60 days (analyst band; statutory cap is 30 days) ME resident >60d
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.