HackingTechnologyInformationVulnerability ExploitData ExfiltratedTargetedIdentity (basic)Government IDCriticalContained

National Public Data

bd_c1e9acb323a8323b · schema v1 · pii pii-v1

Severity

Critical

Discovered

Dec 30, 2023

Filed

Aug 17, 2024

To disclose

33 weeks

Affected · nationwide

1,300,0002,760 in this filing

Linked

5 filings

Confidence

65%

Full breach record for National Public Data →2 incidents on file

National Public Data reported an external system breach (hacking) occurring on December 30, 2023, affecting 1,300,000 individuals nationwide, including 2,760 Maine residents. Compromised data included names, SSNs, emails, phone numbers, and addresses. Notices were sent on August 10, 2024.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Dec 30, 2023 → Filed with AG Aug 17, 2024231d ⏱ ME AG >30d33 weeks discovery → filing

⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Incident timeline

discovery → filing · 33 weeks / 231 days

Dec 30, 2023

Begins

Dec 30, 2023

Discovered

Aug 17, 2024

Filed

vs. sector median

+22 wks slower

This filing is one of 5 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

California State AGbd_d0812cb0df624f1f2024-08-17Verified
Wisconsin State AGbd_cf46d176243265892024-08-12 · +5dVerified
Delaware State AGbd_62daaa80f5351e9a2024-08-10 · +7dVerified
Indiana State AGbd_99a67ea02eeb8bf02024-08-10 · +7dVerified

Name: National Public Data
norm: national public data
Domain: nationalpublicdata.com

Name: National Public Data
norm: national public data
Domain: nationalpublicdata.com
Industry: Technologyllm

Discovered: Dec 30, 2023
Breach occurred: Dec 30, 2023
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Aug 10, 2024
Affected individuals: 1,300,000state + nationwide
Data types: Identity (basic)Government ID
Data elements: Social Security number
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Cooperated with law enforcement and governmental investigators
Initial access: exploit_public_facing

During the incident: Cooperated with law enforcement and governmental investigators
Conducted a review of the potentially affected records
Implemented additional security measures
Changes made: Implemented additional security measures in efforts to prevent the reoccurrence of such a breach and to protect our systems
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 33 weeks(231 days from discovery to filing)
Compliance flags: ME AG >30d · 231dME resident >60d · 224dME CRA notice due
Discovery-date grounding: occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Dec 30, 2023
→ Filed with AG: Aug 17, 2024
231d 30 days (soft) ME AG >30d
Maine
Discovered: Dec 30, 2023
→ Notified: Aug 10, 2024
224d 60 days (analyst band; statutory cap is 30 days) ME resident >60d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Dec 30, 2023 → Filed with AG: Aug 17, 2024	231d	30 days (soft)	ME AG >30d
Maine	Discovered: Dec 30, 2023 → Notified: Aug 10, 2024	224d	60 days (analyst band; statutory cap is 30 days)	ME resident >60d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Delaware State AGAug 10 · first

Indiana State AGAug 10 · first

Wisconsin State AG+2d

California State AG+7d

Maine State AG+7d · this page

Pattern: first filing Aug 10 (DE), last Aug 17 (ME) — a 7-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/25289ca5-a211-4abc-9e29-cbe8d9d5b0e6.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 17, 2024
Raw hash: 41ab16ae0e8dc25ace152d8465ccd8c55823f61ca511d3f669cd8e01837abe58

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityNational Public Data

Victim entityNational Public Data

Incidentdiscovered Dec 30, 2023

Stated responseCooperated with law enforcement and governmental investigators

ComplianceME AG >30d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov