HackingOtherCustomer Data InvolvedData ExfiltratedIdentity (basic)Government IDFinancial accountHealth (basic)CredentialsHighContained

Rockrose Development

bd_b356f77ac2799858 · schema v1 · pii pii-v1

Severity

High

Discovered

Nov 14, 2025

Filed

Dec 12, 2025

To disclose

28 days

Affected · nationwide

47,39229 in this filing

Linked

10 filings

Confidence

66%

Full breach record for Rockrose Development →

Rockrose Development L.L.C. reported an external system breach (hacking) occurring on July 4, 2025, discovered on November 14, 2025. The incident impacted 47,392 individuals, including 29 Maine residents. Compromised data included names, SSNs, driver's licenses, bank account/routing numbers, health insurance info, and online credentials. The company engaged third-party experts, secured systems, and offered 24 months of Experian IdentityWorks.

J jump to incidentP pin to compareR raw source

Leak gap clock⏱ Leak >90d28 days discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 133 days

discovery → filing · 28 days

Jul 4, 2025

Begins

Nov 14, 2025

Discovered

Dec 12, 2025

Filed

vs. sector median

4 wks faster

This filing is one of 10 about the same incident.View merged incident

Linked disclosures

Why this link?

Ransomware claims (2)

Leak Siteplaybd_10cde58814205b0a2025-07-09 · +156dVerified by operator
Leak Siteplaybd_aaa9c5b7ccde1d512025-07-04 · +161dVerified by operator

Regulatory filings (7) · sorted by filing gap

Nebraska State AGbd_00d7163709e0a38c2025-12-12Verified by operator
Massachusetts State AGbd_25c4b263066579c52025-12-12Verified by operator
New Hampshire State AGbd_327fd30fe6daab6c2025-12-12Verified
Indiana State AGbd_75178716da4cecff2025-12-12Verified

Show 3 more filings ↓

Vermont State AGbd_8f67a2bc7c1abe0e2025-12-12Verified
Texas State AGbd_d9ccc4ea910fc3472025-12-12Verified
California State AGbd_dd2409a79ea592452025-12-12Verified

Name: Rockrose Development
norm: rockrose development
Domain: rockrose.com

Name: Rockrose Development
norm: rockrose development
Domain: rockrose.com
Industry: Otherllm

Discovered: Nov 14, 2025
Breach occurred: Jul 4, 2025
Undetected for: 133 daysoccurrence → discovery
Materiality determined: —
Notification sent: Dec 12, 2025
Affected individuals: 47,392state + nationwide
Data types: Identity (basic)Government IDFinancial accountHealth (basic)Credentials
Data elements: Social Security numberMedical information
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Filed notification with Maine Attorney General
Initial access: exploit_public_facing

During the incident: Launched an investigation
Engaged third-party experts to assist in its investigation
Taken steps to secure its systems
Offering complimentary access to Experian IdentityWorks for 24 months
Changes made: Implemented additional cybersecurity safeguards
Working closely with internal and external experts to further enhance the security of our systems
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 28 days(28 days from discovery to filing)
Compliance flags: Leak >90dME AG ≤30d · 28d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Nov 14, 2025
→ Filed with AG: Dec 12, 2025
28d 30 days ME AG ≤30d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Nov 14, 2025 → Filed with AG: Dec 12, 2025	28d	30 days	ME AG ≤30d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 8 filings · 8 states

View merged incident ↗

Nebraska State AGDec 12 · first

Massachusetts State AGDec 12 · first

New Hampshire State AGDec 12 · first

Indiana State AGDec 12 · first

Vermont State AGDec 12 · first

Texas State AGDec 12 · first

California State AGDec 12 · first

Maine State AGDec 12 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/0e9b1638-ed34-411f-b9d4-5f29a1163313.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 12, 2025
Raw hash: e3d43a0f316d227b2c7c38a02832a30f7f6d356869b6c6e8c562fe84f7062a5e

Linked disclosures

Ransomware claims (2)

Regulatory filings (7) · sorted by filing gap

Reporting entityRockrose Development

Victim entityRockrose Development

Incidentdiscovered Nov 14, 2025

Stated responseLaunched an investigation

ComplianceLeak >90d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov