HackingFinancial ServicesFinanceCustomer Data InvolvedTargetedIdentity (basic)Government IDHealth (basic)FinancialHighContained

Worcester Regional Retirement System

bd_b885d97d39d20eb0 · schema v1 · pii pii-v1

Severity

High

Discovered

Jun 10, 2025

Filed

Oct 20, 2025

To disclose

5 weeks

Affected · nationwide

15,805150 in this filing

Linked

6 filings

Confidence

66%

Full breach record for Worcester Regional Retirement System →

Worcester Regional Retirement System reported an external system breach (hacking) occurring on June 10, 2025, discovered on September 15, 2025. Approximately 15,805 individuals were affected, including 150 Maine residents. Compromised data included names, SSNs, driver's licenses, and medical/insurance information. Notices were sent on October 20, 2025, offering 12 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Jun 10, 2025 → Filed with AG Oct 20, 2025132d ⏱ ME AG >30d5 weeks discovery → filing

⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Incident timeline

discovery → filing · 19 weeks / 132 days

Jun 10, 2025

Begins

Jun 10, 2025

Discovered

Oct 20, 2025

Filed

vs. sector median

3 wks faster

This filing is one of 6 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Massachusetts State AGbd_08e43682a5aefe872025-10-20Verified
Montana State AGbd_2eb6868d68a3d5542025-10-20Candidate
Indiana State AGbd_8e4dd1e853edbf292025-10-20Verified
New Hampshire State AGbd_bfa136abfa8226502025-10-20Verified

Show 1 more filing ↓

Nebraska State AGbd_c047a5e7d86bc8752025-10-20Verified

Name: Constangy, Brooks, Smith, and Prophete, LLP
norm: constangy brooks smith and prophete

Name: Worcester Regional Retirement System
norm: worcester regional retirement system
Industry: Financial Servicesllm

Discovered: Jun 10, 2025
Breach occurred: Jun 10, 2025
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Oct 20, 2025
Affected individuals: 15,805state + nationwide
Data types: Identity (basic)Government IDHealth (basic)Financial
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1119 Automated Collection
Threat actor: ExternalFinancial
Regulator citations: Filed Security Breach Notification with Maine Attorney General
Initial access: exploit_public_facing

During the incident: Engaged independent cybersecurity experts
Engaged a third-party vendor to complete a comprehensive and thorough review of the data
Established a toll-free call center through IDX
Notified Maine residents by USPS First Class Mail
Offered complimentary identity protection services including 12 months of credit monitoring
Changes made: Conducted an immediate and comprehensive investigation
Secured its network
Continues to review policies and procedures to implement additional measures
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 weeks(35 days from discovery to filing)
Compliance flags: ME AG >30d · 132dME resident >60d · 132d
Discovery-date grounding: occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Jun 10, 2025
→ Filed with AG: Oct 20, 2025
132d 30 days (soft) ME AG >30d
Maine
Discovered: Jun 10, 2025
→ Notified: Oct 20, 2025
132d 60 days (analyst band; statutory cap is 30 days) ME resident >60d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Jun 10, 2025 → Filed with AG: Oct 20, 2025	132d	30 days (soft)	ME AG >30d
Maine	Discovered: Jun 10, 2025 → Notified: Oct 20, 2025	132d	60 days (analyst band; statutory cap is 30 days)	ME resident >60d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

Massachusetts State AGOct 20 · first

Montana State AGOct 20 · first

Indiana State AGOct 20 · first

New Hampshire State AGOct 20 · first

Nebraska State AGOct 20 · first

Maine State AGOct 20 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/1fb275e4-dd21-4a2b-a4ab-d4a631732a65.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 20, 2025
Raw hash: 5289c5f25782d57f28d0c0953d301cceec58c43609f172587dfed5253b493919

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityConstangy, Brooks, Smith, and Prophete, LLP

Victim entityWorcester Regional Retirement System

Incidentdiscovered Jun 10, 2025

Stated responseEngaged independent cybersecurity experts

ComplianceME AG >30d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov