HackingStolen CredentialsData ExfiltratedCustomer Data InvolvedDelayed DiscoveryPIIIDENTITY_GOVERNMENTFINANCIAL_ACCOUNTAUTHENTICATIONMediumResolved
CFD Investments, Inc. (“CFD”)
bd_ae4f20bdb0fce474 · schema v1 · pii pii-v1
Full breach record for CFD Investments, Inc. (“CFD”) →CFD Investments, Inc. notified 10 Maine residents of unauthorized access to an employee email account occurring between March 15, 2025 and May 9, 2025. Discovered December 16, 2025. Exposed data included names, Social Security numbers, driver's license numbers, and/or financial account numbers. A cybersecurity firm assisted the investigation. Notifications were mailed January 28, 2026. One year of Kroll credit monitoring and identity theft protection was offered.
Maine clockDiscovered Dec 16, 2025 → Filed with AG Jan 28, 202643d ⏱ ME AG >30d6 weeks discovery → filing
⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
This filing is one of 5 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (4) · sorted by filing gap
- bd_90489b77c28869ffNew Hampshire State AGfiled 2026-01-28Verified
- bd_ff9bf83e6fe55f68Indiana State AGfiled 2026-01-28Verified by operator
- bd_fc7b5ef74adf35a7Texas State AGfiled 2026-01-30(2d gap)Verified
- bd_3c1e06c650ed1504California State AGfiled 2025-12-16(43d gap)Candidate
Source provenance
- Source URL
- https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/15da4f24-a7f5-4122-8733-4296b3e53727.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Jan 28, 2026
- Raw hash
- 5e555e2df9b0b5c70efcf91e1204b92a4283795297e58c827631d1c7e26e13bc
Reporting entity
- Name
- CFD Investments, Inc. (“CFD”)norm: cfd investments inc cfd
- Industry
- Other Commercial
Victim entity
- Name
- CFD Investments, Inc. (“CFD”)norm: cfd investments inc cfd
- Industry
- Other Commercial
Incident
- Discovered
- Dec 16, 2025
- Materiality determined
- Dec 16, 2025
- Notification sent
- Jan 28, 2026
- Affected individuals
- 10
- Data types
- PIIIDENTITY_GOVERNMENTFINANCIAL_ACCOUNTAUTHENTICATION
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1078 Valid Accounts
- Threat actor
- External
- Initial access
- valid_credentials
Compliance
- Time to disclose
- 6 weeks(43 days from discovery to filing)
- Compliance flags
- ME AG >30d · 43d
- Discovery-date grounding
- unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
- Clock breakdown
Statute Window Elapsed Threshold Status Maine Discovered: Dec 16, 2025→ Filed with AG: Jan 28, 202643d 30 days (soft) ME AG >30d
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.