HackingProfessional ServicesCustomer Data InvolvedIdentity (basic)Government IDHighContained

Westat, Inc.

bd_be6506ff947b42aa · schema v1 · pii pii-v1

Severity

High

Discovered

Jun 22, 2023

Filed

Jul 21, 2023

To disclose

29 days

Affected · nationwide

7,95465 in this filing

Linked

11 records

Confidence

50%

Full breach record for Westat, Inc. →2 incidents on file

Westat, Inc. experienced an external system breach on May 29, 2023, which was discovered on June 22, 2023. The breach compromised the names and Social Security numbers of 7,954 individuals, including 65 residents of Maine. Affected individuals were notified on July 21, 2023, and offered 12 months of credit monitoring and identity protection services through IDX.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Jun 22, 2023 → Filed with AG Jul 21, 202329d ✓ ME AG ≤30d29 days discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 24 days

discovery → filing · 29 days

May 29, 2023

Begins

Jun 22, 2023

Discovered

Jul 21, 2023

Filed

This filing is one of 11 records about the same incident.View merged incident

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Sitecl0pbd_752092ce6faa5dd32023-07-10 · +11dVerified by operator

Regulatory filings (9) · sorted by filing gap

Vermont State AGbd_03476d52a3c7f6702023-07-21Verified
New Hampshire State AGbd_241c67cca32741002023-07-21Verified by operator
Montana State AGbd_8839ed78d84140492023-07-21Candidate
Indiana State AGbd_991dc2d92271be1c2023-07-21Verified by operator

Show 5 more filings ↓up to 105d gap

Massachusetts State AGbd_f7f9fd512c2dec0d2023-07-21Verified by operator
Indiana State AGbd_4027da82b6e67c622023-10-13 · +84dVerified
HHS OCRbd_5b63e0b82f445a712023-10-13 · +84dVerified
South Carolina State AGbd_2e1ea343e7bb4ee72023-10-16 · +87dVerified by operator
HHS OCRbd_0a5c6e5ef62bfc8d2023-11-03 · +105dCandidate

Name: Westat, Inc.
norm: westat
Domain: westat.com

Name: Westat, Inc.
norm: westat
Domain: westat.com

Discovered: Jun 22, 2023
Breach occurred: May 29, 2023
Undetected for: 24 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jul 21, 2023
Affected individuals: 7,954state + nationwide
Data types: Identity (basic)Government ID
Data elements: Social Security number
Attack vector: Unauthorized Access

Changes made: Offered 12 months of credit monitoring and identity protection services provided by IDX.
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 29 days(29 days from discovery to filing)
Compliance flags: ME AG ≤30d · 29d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Jun 22, 2023
→ Filed with AG: Jul 21, 2023
29d 30 days ME AG ≤30d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Jun 22, 2023 → Filed with AG: Jul 21, 2023	29d	30 days	ME AG ≤30d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 10 filings · 8 states

View merged incident ↗

Vermont State AGJul 21 · first

New Hampshire State AGJul 21 · first

Montana State AGJul 21 · first

Indiana State AGJul 21 · first

Massachusetts State AGJul 21 · first

Maine State AGJul 21 · first · this page

Indiana State AG+84d

HHS OCR+84d

South Carolina State AG+87d

HHS OCR+105d

Pattern: first filing Jul 21 (VT), last Nov 3 (MD) — a 105-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/5f2fb11a-3b55-4a52-aa09-d50b7a996691.shtml
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 21, 2023
Raw hash: 50ed27dbc094369fe4d641c971796e6b911beea056d1125213974a7f4e254a52

Linked disclosures

Ransomware claims (1)

Regulatory filings (9) · sorted by filing gap

Reporting entityWestat, Inc.

Victim entityWestat, Inc.

Incidentdiscovered Jun 22, 2023

Stated responseOffered 12 months of credit monitoring and identity protection services provided by IDX.

ComplianceME AG ≤30d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov