HackingTechnologyInformationStolen CredentialsCustomer Data InvolvedIdentity (basic)PIIMediumContained

DRT, LLC

bd_acd22dd3db543f3f · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jun 11, 2025

Filed

Jul 9, 2025

To disclose

28 days

Affected · nationwide

14,4705 in this filing

Linked

8 filings

Confidence

66%

Full breach record for DRT, LLC →2 incidents on file

DRT, LLC experienced an external system breach on May 29, 2025, involving unauthorized remote access to email accounts. The incident was discovered on June 11, 2025. Approximately 14,470 individuals were affected, including 5 Maine residents. PII, including names and demographic information, may have been accessed. DRT disabled accounts, reset passwords, revoked logins, and offered 12 months of credit monitoring through IDX.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Jun 11, 2025 → Filed with AG Jul 9, 202528d ✓ ME AG ≤30d28 days discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 13 days

discovery → filing · 28 days

May 29, 2025

Begins

Jun 11, 2025

Discovered

Jul 9, 2025

Filed

vs. sector median

15 wks faster

This filing is one of 8 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (7) · sorted by filing gap

New Hampshire State AGbd_000e40111cddf8a12025-07-10 · +1dVerified
Indiana State AGbd_00e4b724192c38a12025-07-10 · +1dVerified
Montana State AGbd_2e4b2d43940fa7732025-07-10 · +1dVerified
Texas State AGbd_4f88513128decf542025-07-10 · +1dVerified

Show 3 more filings ↓up to 8d gap

Massachusetts State AGbd_63fcd95518131e362025-07-10 · +1dVerified
Nebraska State AGbd_6b75249079bdc99f2025-07-10 · +1dVerified
Illinois State AGbd_fd163b3e7a927a3b2025-07-01 · +8dVerified

Name: DRT, LLC
norm: drt

Name: DRT, LLC
norm: drt
Industry: Technologyllm

Discovered: Jun 11, 2025
Breach occurred: May 29, 2025
Undetected for: 13 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jul 10, 2025
Affected individuals: 14,470state + nationwide
Data types: Identity (basic)PII
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1114 Email Collection
Threat actor: External
Initial access: valid_credentials

During the incident: Immediately disabling the email accounts
Performing a password reset
Revoking all active user logins
Revoking multi-factor authentication
Monitoring the user's activity within on-premises and cloud-based environments
Offering identity theft protection services through IDX
Changes made: Implementing additional technologies designed to prevent similar attacks
Implementing more extensive logging and real-time reporting
Exploring options for further hardening authentication standards
Providing expanded cybersecurity training for employees
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 28 days(28 days from discovery to filing)
Compliance flags: ME AG ≤30d · 28d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Jun 11, 2025
→ Filed with AG: Jul 9, 2025
28d 30 days ME AG ≤30d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Jun 11, 2025 → Filed with AG: Jul 9, 2025	28d	30 days	ME AG ≤30d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 8 filings · 8 states

View merged incident ↗

Illinois State AGJul 1 · first

Maine State AG+8d · this page

New Hampshire State AG+9d

Indiana State AG+9d

Montana State AG+9d

Texas State AG+9d

Massachusetts State AG+9d

Nebraska State AG+9d

Pattern: first filing Jul 1 (IL), last Jul 10 (NE) — a 9-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/d0b33c1b-1d09-478b-b237-d99b999b9926.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 9, 2025
Raw hash: d0fd7d9913379a41b7683c90ff732c8b4e3c75c49cc3cadb7f521323ca132757

Linked disclosures

Regulatory filings (7) · sorted by filing gap

Reporting entityDRT, LLC

Victim entityDRT, LLC

Incidentdiscovered Jun 11, 2025

Stated responseImmediately disabling the email accounts

ComplianceME AG ≤30d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov