DisclosureLens
HackingProfessional ServicesCustomer Data InvolvedFinancial accountFinancial credentialsMedium

Limbach Facility Services LLC

bd_c3d6f0522c6d3f0f · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jun 12, 2023

Filed

Jun 22, 2023

To disclose

10 days

Affected · nationwide

5,60411 in this filing

Linked

4 filings

Confidence

65%
Full breach record for Limbach Facility Services LLC →2 incidents on file

Limbach Facility Services LLC reported an external system breach that occurred from April 19 to April 22, 2023, and was discovered on June 12, 2023. The breach compromised financial account numbers or credit/debit card numbers along with their corresponding security codes. Notification was sent to 11 affected Maine residents on June 22, 2023. The company offered 12 months of credit monitoring and identity theft protection services through IDX.

Maine clockDiscovered Jun 12, 2023 → Filed with AG Jun 22, 202310d ✓ ME AG ≤30d10 days discovery → filing
⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 54 days
discovery → filing · 10 days

Apr 19, 2023

Begins

Jun 12, 2023

Discovered

Jun 22, 2023

Filed

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Filing propagation · 4 filings · 4 states

View merged incident ↗
Indiana State AGJun 22 · first
Massachusetts State AGJun 22 · first
Maine State AGJun 22 · first · this page
New Hampshire State AG+7d

Pattern: first filing Jun 22 (IN), last Jun 29 (NH) — a 7-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.