HackingGovernmentGovernmentData ExfiltratedTargetedIdentity (basic)Government IDFinancial accountHighContained

ASMFC: Atlantic States Marine Fisheries Commission

bd_b4fb1ab69fdd8c23 · schema v1 · pii pii-v1

Severity

High

Discovered

Apr 6, 2024

Filed

Jul 1, 2024

To disclose

12 weeks

Affected · nationwide

9,8953,823 in this filing

Linked

7 filings

Confidence

66%

Full breach record for ASMFC: Atlantic States Marine Fisheries Commission →

Atlantic States Marine Fisheries Commission (ASMFC) disclosed a cybersecurity incident affecting 9,895 individuals, including 3,823 Maine residents. The breach, occurring between March 14 and April 6, 2024, involved unauthorized access to electronic systems. Compromised data included names, addresses, SSNs, bank account numbers, and copies of government IDs. ASMFC notified law enforcement, engaged third-party experts, and offered 24 months of identity protection services through IDX.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Apr 6, 2024 → Filed with AG Jul 1, 202486d ⏱ ME AG >30d12 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 23 days

discovery → filing · 12 weeks / 86 days

Mar 14, 2024

Begins

Apr 6, 2024

Discovered

Jul 1, 2024

Filed

vs. sector median

+1 wks slower

This filing is one of 7 about the same incident.View merged incident

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Site8basebd_cdcd3bad1829f42f2024-04-15 · +77dVerified by operator

Regulatory filings (5) · sorted by filing gap

Massachusetts State AGbd_5a7397fc9e658c222024-07-01Verified by operator
New Hampshire State AGbd_bbdb037c54a80cf62024-07-03 · +2dVerified
Montana State AGbd_1488322330afd4be2024-06-28 · +3dVerified by operator
Vermont State AGbd_726cfd676d23a28b2024-06-28 · +3dVerified

Show 1 more filing ↓up to 20d gap

Massachusetts State AGbd_7a8bc6310304f49e2024-06-11 · +20dVerified by operator

Name: ASMFC: Atlantic States Marine Fisheries Commission
norm: asmfc atlantic states marine fisheries commission
Domain: asmfc.org

Name: ASMFC: Atlantic States Marine Fisheries Commission
norm: asmfc atlantic states marine fisheries commission
Domain: asmfc.org
Industry: Governmentllm

Discovered: Apr 6, 2024
Breach occurred: Mar 14, 2024 – Apr 6, 2024
Undetected for: 23 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jun 28, 2024
Affected individuals: 9,895state + nationwide
Data types: Identity (basic)Government IDFinancial account
Data elements: Social Security number
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Filed breach notification with Maine Attorney General
Initial access: exploit_public_facing

During the incident: Notified law enforcement
Engaged third-party experts to secure systems and investigate
Restored operations
Augmented security practices
Changes made: Augmented security practices to minimize risk of similar incident
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 12 weeks(86 days from discovery to filing)
Compliance flags: ME AG >30d · 86dME resident >60d · 83dLeak >30dME CRA notice due
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Apr 6, 2024
→ Filed with AG: Jul 1, 2024
86d 30 days (soft) ME AG >30d
Maine
Discovered: Apr 6, 2024
→ Notified: Jun 28, 2024
83d 60 days (analyst band; statutory cap is 30 days) ME resident >60d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Apr 6, 2024 → Filed with AG: Jul 1, 2024	86d	30 days (soft)	ME AG >30d
Maine	Discovered: Apr 6, 2024 → Notified: Jun 28, 2024	83d	60 days (analyst band; statutory cap is 30 days)	ME resident >60d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 5 states

View merged incident ↗

Massachusetts State AGJun 11 · first

Montana State AG+17d

Vermont State AG+17d

Massachusetts State AG+20d

Maine State AG+20d · this page

New Hampshire State AG+22d

Pattern: first filing Jun 11 (MA), last Jul 3 (NH) — a 22-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/996e1ee5-bf14-469e-9cc9-fdcfa8fd3987.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 1, 2024
Raw hash: 5e80b7f7ec9050cdc1c54122943139bf68c269f9ac78b56b84805f121bcaf394

Linked disclosures

Ransomware claims (1)

Regulatory filings (5) · sorted by filing gap

Reporting entityASMFC: Atlantic States Marine Fisheries Commission

Victim entityASMFC: Atlantic States Marine Fisheries Commission

Incidentdiscovered Apr 6, 2024

Stated responseNotified law enforcement

ComplianceME AG >30d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov