HackingProfessional ServicesProfessional ServicesData ExfiltratedTargetedIdentity (basic)Government IDFinancial accountMediumContained

Gelinas & Ward LLP

bd_a7346ce3baf6acd8 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Nov 6, 2024

Filed

Jun 26, 2025

To disclose

33 weeks

Affected

6state residents only

Linked

6 filings

Confidence

66%

Full breach record for Gelinas & Ward LLP →

Gelinas & Ward LLP reported an external system breach (hacking) on November 6, 2024, affecting 6 Maine residents. Unauthorized access resulted in the copying of files containing names, SSNs, driver's license numbers, and payment card numbers. The firm notified federal law enforcement and provided 12 months of credit monitoring via TransUnion to affected individuals.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Nov 6, 2024 → Filed with AG Jun 26, 2025232d ✗ ME AG >90d33 weeks discovery → filing

Incident timeline

discovery → filing · 33 weeks / 232 days

Nov 6, 2024

Begins

Nov 6, 2024

Discovered

Jun 26, 2025

Filed

vs. sector median

+14 wks slower

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Massachusetts State AGbd_3713e7dbc24c890c2025-06-26Verified
Vermont State AGbd_ad7590a1ec3e17f22025-06-26Verified
New Hampshire State AGbd_ba60308e204d51332025-06-26Candidate
Massachusetts State AGbd_cf4241c3b67f5b5e2025-07-08 · +12dVerified by operator

Show 1 more filing ↓up to 43d gap

New Hampshire State AGbd_7a6fa05d81dad7c22025-08-08 · +43dVerified

Name: Gelinas & Ward LLP
norm: gelinas ward
Domain: gelinasandward.com
Industry: Legal Services

Name: Gelinas & Ward LLP
norm: gelinas ward
Domain: gelinasandward.com
Industry: Legal Services
Industry: Professional Servicesllm

Discovered: Nov 6, 2024
Breach occurred: Nov 6, 2024
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jun 26, 2025
Affected individuals: 6state-resident count only
Data types: Identity (basic)Government IDFinancial account
Data elements: Social Security numberDate of birth
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1119 Automated Collection
Threat actor: ExternalFinancial
Regulator citations: Providing written notice of this incident to relevant state regulators
Initial access: exploit_public_facing

During the incident: Notified federal law enforcement regarding the event
Providing access to complimentary credit monitoring services for twelve (12) months, through TransUnion
Providing impacted individuals with guidance on how to better protect against identity theft and fraud
Working to implement additional safeguards and training to its employees
Changes made: Implementing additional safeguards and training to its employees
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 33 weeks(232 days from discovery to filing)
Compliance flags: ME AG >90d · 232dME resident >60d · 232d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Nov 6, 2024
→ Filed with AG: Jun 26, 2025
232d 90 days ME AG >90d
Maine
Discovered: Nov 6, 2024
→ Notified: Jun 26, 2025
232d 60 days (analyst band; statutory cap is 30 days) ME resident >60d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Nov 6, 2024 → Filed with AG: Jun 26, 2025	232d	90 days	ME AG >90d
Maine	Discovered: Nov 6, 2024 → Notified: Jun 26, 2025	232d	60 days (analyst band; statutory cap is 30 days)	ME resident >60d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 4 states

View merged incident ↗

Massachusetts State AGJun 26 · first

Vermont State AGJun 26 · first

New Hampshire State AGJun 26 · first

Maine State AGJun 26 · first · this page

Massachusetts State AG+12d

New Hampshire State AG+43d

Pattern: first filing Jun 26 (MA), last Aug 8 (NH) — a 43-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/42a56e96-8068-477e-922c-9f2814f1d57c.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 26, 2025
Raw hash: ef16582e3f6f3964248f3c0f45a456cd04e156d707bfb9573a0a389b5099fa8a

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityGelinas & Ward LLP

Victim entityGelinas & Ward LLP

Incidentdiscovered Nov 6, 2024

Stated responseNotified federal law enforcement regarding the event

ComplianceME AG >90d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov