HackingProfessional ServicesProfessional ServicesDelayed DiscoveryCustomer Data InvolvedIdentity (basic)MediumContained

Scott & Kraus, LLC

bd_ba5d302e7bd9bcd2 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Dec 16, 2025

Filed

Dec 22, 2025

To disclose

6 days

Affected · nationwide

1,0492 in this filing

Linked

6 filings

Confidence

65%

Full breach record for Scott & Kraus, LLC →

Scott & Kraus, LLC reported an external system breach (hacking) on February 27, 2025, affecting 1,049 individuals. The breach was discovered on December 16, 2025, after an investigation confirmed unauthorized access. Notices were sent on December 22, 2025. Affected data included names and other personal identifiers. 2 Maine residents were affected. IDX provided 12 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Leak gap clock✗ Leak >180d6 days discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 292 days

discovery → filing · 6 days

Feb 27, 2025

Begins

Dec 16, 2025

Discovered

Dec 22, 2025

Filed

vs. sector median

16 wks faster

This filing is one of 6 about the same incident.View merged incident

A leak claim by kraken about this victim predates this filing by 307 days.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Sitekrakenbd_b375be346cf01bcf2025-02-18 · +307dVerified by operator

Regulatory filings (4) · sorted by filing gap

New Hampshire State AGbd_17d9abb1684f6bc22025-12-22Verified
Indiana State AGbd_8218a01bb4c05dcc2025-12-22Verified
Massachusetts State AGbd_74debd7e4e5bbc4f2025-12-23 · +1dVerified
Illinois State AGbd_6baebbfa45ccfdc82025-12-01 · +21dCandidate

Name: Constangy, Brooks, Smith & Prophete, LLP
norm: constangy brooks smith prophete

Name: Scott & Kraus, LLC
norm: scott kraus
Domain: skcounsel.com
Industry: Professional Servicesllm

Discovered: Dec 16, 2025
Breach occurred: Feb 27, 2025
Undetected for: 292 daysoccurrence → discovery
Materiality determined: —
Notification sent: Dec 22, 2025
Affected individuals: 1,049state + nationwide
Data types: Identity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1078 Valid Accounts
Threat actor: External
Regulator citations: Filed notification with Maine Attorney General
Initial access: exploit_public_facing

During the incident: Launched an investigation with the support of external cybersecurity experts
Worked with additional experts to conduct a comprehensive review
Took steps to further secure our IT environment
Implementing enhanced security measures
Changes made: Implementing enhanced security measures to help prevent a similar incident from occurring in the future
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 days(6 days from discovery to filing)
Compliance flags: Leak >180dME AG ≤30d · 6d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Dec 16, 2025
→ Filed with AG: Dec 22, 2025
6d 30 days ME AG ≤30d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Dec 16, 2025 → Filed with AG: Dec 22, 2025	6d	30 days	ME AG ≤30d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Illinois State AGDec 1 · first

New Hampshire State AG+21d

Indiana State AG+21d

Maine State AG+21d · this page

Massachusetts State AG+22d

Pattern: first filing Dec 1 (IL), last Dec 23 (MA) — a 22-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/c599e489-1320-423c-80fb-a787d069f786.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 22, 2025
Raw hash: 85e6e3dc951304e4409414257100434a47623ce5e3a66faa9caf93bb1186698b

Linked disclosures

Ransomware claims (1)

Regulatory filings (4) · sorted by filing gap

Reporting entityConstangy, Brooks, Smith & Prophete, LLP

Victim entityScott & Kraus, LLC

Incidentdiscovered Dec 16, 2025

Stated responseLaunched an investigation with the support of external cybersecurity experts

ComplianceLeak >180d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov