HackingProfessional ServicesFinancial ServicesFinanceCustomer Data InvolvedDelayed DiscoveryPIILowContained
Mengel, Metzger, Barr & Co., LLP
bd_b8fa640dea001fc6 · schema v1 · pii pii-v1
Full breach record for Mengel, Metzger, Barr & Co., LLP →Mengel, Metzger, Barr & Co., LLP (MMB+CO), an accounting firm based in Latham, NY, experienced an external cyberattack on February 21, 2025. The breach was discovered on May 19, 2025. Personally identifiable information of 10,380 individuals may have been affected, including 29 Maine residents. Consumer notification letters were sent June 26, 2025. Experian credit monitoring (12 months) was offered to affected individuals.
Maine clockDiscovered May 19, 2025 → Filed with AG Jun 26, 202538d ⏱ ME AG >30d5 weeks discovery → filing
⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
This filing is one of 4 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (3) · sorted by filing gap
- bd_57b7a00d71b4193cIndiana State AGfiled 2025-06-26Verified
- bd_a6330afa9f49b540New Hampshire State AGfiled 2025-06-30(4d gap)Candidate
- bd_b51da914afab0b17New Hampshire State AGfiled 2025-07-21(25d gap)Verified
Source provenance
- Source URL
- https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/d6c73c83-7948-4d55-8c89-6c5ae8071a6f.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Jun 26, 2025
- Raw hash
- be6301104a3f689fef1a7c2d704180f7e2a20c7f4064799bcfa0d4ea52dafafb
Reporting entity
- Name
- Mengel, Metzger, Barr & Co., LLPnorm: mengel metzger barr
- Industry
- Accounting Services
Victim entity
- Name
- Mengel, Metzger, Barr & Co., LLPnorm: mengel metzger barr
- Industry
- Accounting Services
- Industry
- Professional ServicesllmFinancial Servicesllm
Incident
- Discovered
- May 19, 2025
- Materiality determined
- —
- Notification sent
- Jun 26, 2025
- Affected individuals
- 29
- Data types
- PII
- Attack vector
- Unauthorized Access
- Threat actor
- External
Compliance
- Time to disclose
- 5 weeks(38 days from discovery to filing)
- Compliance flags
- ME AG >30d · 38d
- Discovery-date grounding
- unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
- Clock breakdown
Statute Window Elapsed Threshold Status Maine Discovered: May 19, 2025→ Filed with AG: Jun 26, 202538d 30 days (soft) ME AG >30d
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.