DisclosureLens
MalwareRetail & ConsumerRetailRansomwarePlayData ExfiltratedData EncryptedRansom DemandedTargetedIdentity (basic)Government IDFinancial accountHealth (basic)PHIHighActive

Oldenburg Group Incorporated

bd_c38202311c38d9a7 · schema v1 · pii pii-v1

Severity

High

Discovered

May 5, 2024

Filed

Sep 10, 2024

To disclose

18 weeks

Affected · nationwide

4,5001 in this filing

Linked

4 filings

Confidence

66%
Full breach record for Oldenburg Group Incorporated

Oldenburg Group Incorporated reported a ransomware incident involving the Play group. The breach occurred May 4-5, 2024, and was discovered May 5, 2024. Approximately 4,500 individuals were affected, including 1 Maine resident. Compromised data included names, SSNs, driver's licenses, financial accounts, and medical information. The company engaged forensic investigators and offered 12 months of credit monitoring.

Maine clockDiscovered May 5, 2024Filed with AG Sep 10, 2024128d ME AG >90d18 weeks discovery → filing
AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 1 days
discovery → filing · 18 weeks / 128 days

May 4, 2024

Begins

May 5, 2024

Discovered

Sep 10, 2024

Filed

vs. sector median

+11 wks slower

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Filing propagation · 4 filings · 4 states

View merged incident ↗
Indiana State AGMay 30 · first
Maine State AG+103d · this page

Pattern: first filing May 30 (IN), last Sep 10 (ME) — a 103-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.