HackingProfessional ServicesProfessional ServicesDelayed DiscoveryLowActive

Mercadien PC Certified Public Accountants

bd_be4f63906a17f728 · schema v1 · pii pii-v1

Severity

Low

Discovered

Nov 7, 2025

Filed

Dec 31, 2025

To disclose

8 weeks

Affected

Not disclosed

Linked

9 filings

Confidence

65%

Full breach record for Mercadien PC Certified Public Accountants →

Mercadien PC, a CPA firm, reported an external system breach (hacking) occurring on September 17, 2025, discovered on November 7, 2025. The total number of affected individuals is TBD. Notification was sent on December 1, 2025. The investigation is ongoing.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Nov 7, 2025 → Filed with AG Dec 31, 202554d ⏱ ME AG >30d8 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 51 days

discovery → filing · 8 weeks / 54 days

Sep 17, 2025

Begins

Nov 7, 2025

Discovered

Dec 31, 2025

Filed

vs. sector median

11 wks faster

This filing is one of 9 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (8) · sorted by filing gap

New Hampshire State AGbd_6a472f77725ed7622026-01-05 · +5dVerified
Massachusetts State AGbd_e681ed6e473e0a2f2025-12-24 · +7dVerified
Indiana State AGbd_5a136d8dad7a13462026-02-17 · +48dVerified
Nebraska State AGbd_9581ab095364e27d2026-02-17 · +48dVerified

Show 4 more filings ↓up to 201d gap

Delaware State AGbd_b06b2f75cc90e4452026-02-17 · +48dVerified
South Carolina State AGbd_bb8b76494cae40c62026-02-23 · +54dVerified
Texas State AGbd_7b787e3dbbd82d8e2026-02-24 · +55dVerified
New Hampshire State AGbd_aea05dfcc088a1bf2026-07-20 · +201dVerified

Name: Mercadien PC Certified Public Accountants
norm: mercadien pc certified public accountants

Name: Mercadien PC Certified Public Accountants
norm: mercadien pc certified public accountants
Industry: Professional Servicesllm

Discovered: Nov 7, 2025
Breach occurred: Sep 17, 2025
Undetected for: 51 daysoccurrence → discovery
Materiality determined: —
Notification sent: Dec 1, 2025
Affected individuals: Not disclosed
Data types: —
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: External
Initial access: exploit_public_facing

During the incident: Began working with forensic cybersecurity professionals to investigate the situation, secure our systems, and determine exactly what data may be affected
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 weeks(54 days from discovery to filing)
Compliance flags: ME AG >30d · 54d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Nov 7, 2025
→ Filed with AG: Dec 31, 2025
54d 30 days (soft) ME AG >30d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Nov 7, 2025 → Filed with AG: Dec 31, 2025	54d	30 days (soft)	ME AG >30d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 9 filings · 8 states

View merged incident ↗

Massachusetts State AGDec 24 · first

Maine State AG+7d · this page

New Hampshire State AG+12d

Indiana State AG+55d

Nebraska State AG+55d

Delaware State AG+55d

South Carolina State AG+61d

Texas State AG+62d

New Hampshire State AG+208d

Pattern: first filing Dec 24 (MA), last Jul 20 (NH) — a 208-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/4d8d003f-1b63-4f61-8564-32582d217590.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 31, 2025
Raw hash: 5a98ca2e87a1ebb0449d66448d955688b20ee1e4c74f2d4ad764313bd38f486b

Linked disclosures

Regulatory filings (8) · sorted by filing gap

Reporting entityMercadien PC Certified Public Accountants

Victim entityMercadien PC Certified Public Accountants

Incidentdiscovered Nov 7, 2025

Stated responseBegan working with forensic cybersecurity professionals to investigate the situation, secure our systems, and determine exactly what data may be affected

ComplianceME AG >30d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov