MalwareCapture App DataMalware OtherSupply Chain (3P Vendor)Customer Data InvolvedFinancial accountFinancial credentialsLowContained

Penn, LLC

bd_a7ce0a9eecbd10eb · schema v1 · pii pii-v1

Severity

Low

Discovered

Feb 15, 2022

Filed

Mar 15, 2022

To disclose

28 days

Affected

127scope not determined

Linked

16 filings

Confidence

50%

Full breach record for Penn, LLC →

PulseTV, a subsidiary of Penn LLC, reported a data breach that affected its customers. The breach was caused by a malware attack on a webserver hosted and maintained by Freestyle Solutions, a third-party vendor that hosts PulseTV's website. The malware captured customers' payment card data between November 2019 and February 2022. This notification is a supplement to previous notices, adding 127 Maine residents to the list of those affected.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Feb 15, 2022 → Filed with AG Mar 15, 202228d ✓ ME AG ≤30d28 days discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 837 days

discovery → filing · 28 days

Nov 1, 2019

Begins

Feb 15, 2022

Discovered

Mar 15, 2022

Filed

This filing is one of 16 filings about the same incident.View merged incident

Part of FreeStyle Solutions supply-chain incident (2022) — a supply-chain cascade affecting multiple organizations.View cascade →

Linked disclosures

Why this link?

Regulatory filings (10) · sorted by filing gap

Delaware State AGbd_5ae0a6102d57b5142022-03-15Verified by operator
California State AGbd_7f255a5dfe84e7ec2022-03-15Verified by operator
New Hampshire State AGbd_5fb463d40ca02c442022-03-18 · +3dVerified by operator
New Hampshire State AGbd_b1f86ecba6b262572022-01-27 · +47dVerified by operator

Show 6 more filings ↓up to 50d gap

California State AGbd_1f86650296908cc12022-01-25 · +49dVerified by operator
Indiana State AGbd_73bf248be5b5c7b52022-01-25 · +49dVerified by operator
South Carolina State AGbd_758e0a44c15a009c2022-01-25 · +49dVerified by operator
Massachusetts State AGbd_a820dca495f3145d2022-01-25 · +49dVerified by operator
Montana State AGbd_3cd97ab2fd5423fa2022-01-24 · +50dVerified by operator
Delaware State AGbd_64f99c9c7e03f0922022-01-24 · +50dVerified by operator

Showing first 10 of 15 linked disclosures.

Name: Penn, LLC
norm: penn

Name: Penn, LLC
norm: penn
Also named: Penn LLCdba oflegal entity
Pulse TVdba oftrade name

Discovered: Feb 15, 2022
Breach occurred: Nov 1, 2019 – Feb 2, 2022
Undetected for: 837 daysoccurrence → discovery
Materiality determined: —
Notification sent: Mar 15, 2022
Affected individuals: 127scope not determined
Data types: Financial accountFinancial credentials
Data elements: Financial account number
Attack vector: Third-Party / Supply Chain

During the incident: Confirmed the malware was disabled
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 28 days(28 days from discovery to filing)
Compliance flags: ME AG ≤30d · 28d
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Feb 15, 2022
→ Filed with AG: Mar 15, 2022
28d 30 days ME AG ≤30d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Feb 15, 2022 → Filed with AG: Mar 15, 2022	28d	30 days	ME AG ≤30d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 11 filings · 8 states

View merged incident ↗

Montana State AGJan 24 · first

Delaware State AGJan 24 · first

California State AG+1d

Indiana State AG+1d

South Carolina State AG+1d

Massachusetts State AG+1d

New Hampshire State AG+3d

Delaware State AG+50d

California State AG+50d

Maine State AG+50d · this page

New Hampshire State AG+53d

Pattern: first filing Jan 24 (MT), last Mar 18 (NH) — a 53-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Cascade drawn from the first 10 linked disclosures of 15 — the full spread may be wider.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/876ea25b-c72e-4e23-b5b0-bfbd71a578c5.shtml
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 15, 2022
Raw hash: d47ff70f11eafc265fd643a9c623ce9de597fcf197a265a23b11c50f18dcd2ee

Linked disclosures

Regulatory filings (10) · sorted by filing gap

Reporting entityPenn, LLC

Victim entityPenn, LLC

Incidentdiscovered Feb 15, 2022

Stated responseConfirmed the malware was disabled

ComplianceME AG ≤30d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov