HackingStolen CredentialsCustomer Data InvolvedTargetedIDENTITY_BASICIDENTITY_GOVERNMENTFINANCIAL_ACCOUNTMediumContained
Xactus
bd_b201cf22b42a232e · schema v1 · pii pii-v1
Full breach record for Xactus →Xactus LLC notified the Maryland AG of unauthorized access to a single email account between June 26 and July 15, 2024. The incident affected 96 Maryland residents, exposing names, SSNs, driver's license numbers, and financial account numbers. Xactus engaged forensic specialists, secured the environment, and provided 24 months of credit monitoring to affected individuals.
Maryland clock✗ MD AG >90d31 weeks discovery → filing
⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed96 affectedView incident
Source provenance
- Source URL
- https://oag.maryland.gov/resources-info/SBN%20Documents/2025/ITU-376361.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Feb 14, 2025
- Raw hash
- f0a5410046fb7641903e4d51acc7bd940f6b72bc4820ee816cfcc15a7c647be9
Reporting entity
- Name
- Mullen Coughlin LLCnorm: mullen coughlin
Victim entity
- Name
- Xactusnorm: xactus
- Domain
- xactus360.com
Incident
- Discovered
- Jul 15, 2024
- Materiality determined
- —
- Notification sent
- Feb 14, 2025
- Affected individuals
- 96
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENTFINANCIAL_ACCOUNT
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1078 Valid AccountsT1114 Email Collection
- Threat actor
- ExternalFinancial
- Regulator citations
- Provided written notice of this incident to relevant state regulators
- Initial access
- valid_credentials
Compliance
- Time to disclose
- 31 weeks(214 days from discovery to filing)
- Compliance flags
- MD AG >90d
- Discovery-date grounding
- unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.