HackingHealthcareHealthcareCustomer Data InvolvedIdentity (basic)Financial accountLowContained

Buena Vista Management Services, LLC

bd_a9d92ba58da5ad35 · schema v1 · pii pii-v1

Severity

Low

Discovered

Dec 8, 2025

Filed

Apr 10, 2026

To disclose

18 weeks

Affected

1state residents only

Linked

2 filings

Confidence

66%

Full breach record for Buena Vista Management Services, LLC →2 incidents on file

Buena Vista Management Services, LLC dba Windward Life Care reported an external system breach (hacking) on December 8, 2025, discovered on April 6, 2026. One Maine resident was affected. The incident involved unauthorized viewing or copying of personal information, including names and financial account numbers. The company retained forensic specialists and legal counsel, and offered 12 months of credit monitoring and fraud assistance via TransUnion/Cyberscout.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Dec 8, 2025 → Filed with AG Apr 10, 2026123d ✗ ME AG >90d18 weeks discovery → filing

⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Incident timeline

discovery → filing · 18 weeks / 123 days

Dec 8, 2025

Begins

Dec 8, 2025

Discovered

Apr 10, 2026

Filed

vs. sector median

+6 wks slower

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Massachusetts State AGbd_44c5b848c50737ff2026-04-10Candidate

Name: Buena Vista Management Services, LLC
norm: buena vista management

Name: Buena Vista Management Services, LLC
norm: buena vista management
Also named: Buena Vista Management Services, LLCdba oflegal entity
Windward Life Caredba oftrade name
Industry: Healthcarellm

Discovered: Dec 8, 2025
Breach occurred: Dec 8, 2025
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Apr 10, 2026
Affected individuals: 1state-resident count only
Data types: Identity (basic)Financial account
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: ExternalFinancial
Regulator citations: Filed notification with Maine Attorney General
Initial access: exploit_public_facing

During the incident: Retained legal counsel and third-party forensic specialists to investigate the unusual activity
Began a comprehensive review of the data set to determine what sensitive and/or personal information was impacted
Providing access to Single Bureau Credit Monitoring/Single Bureau Credit Report/Single Bureau Credit Score services at no charge
Providing proactive fraud assistance through Cyberscout, a TransUnion company
Changes made: Moved promptly to investigate and respond to the event
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 18 weeks(123 days from discovery to filing)
Compliance flags: ME AG >90d · 123dLeak >90d
Discovery-date grounding: occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Dec 8, 2025
→ Filed with AG: Apr 10, 2026
123d 90 days ME AG >90d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Dec 8, 2025 → Filed with AG: Apr 10, 2026	123d	90 days	ME AG >90d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Massachusetts State AGApr 10 · first

Maine State AGApr 10 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/1502ed39-ff0b-4391-898b-cff2e5fe1b3a.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 10, 2026
Raw hash: 63e50804f7a6c9111db129e6b0cd37e693b99abcec136004e7575c4bf87e94dc

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityBuena Vista Management Services, LLC

Victim entityBuena Vista Management Services, LLC

Incidentdiscovered Dec 8, 2025

Stated responseRetained legal counsel and third-party forensic specialists to investigate the unusual activity

ComplianceME AG >90d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov