HackingProfessional ServicesProfessional ServicesStolen CredentialsData ExfiltratedCustomer Data InvolvedDelayed DiscoveryIdentity (basic)Government IDHighActive

One Point HR Solutions, Inc.

bd_c44fb15ebe89684a · schema v1 · pii pii-v1

Severity

High

Discovered

Sep 9, 2024

Filed

Oct 11, 2024

To disclose

5 weeks

Affected · nationwide

22,8853 in this filing

Linked

9 filings

Confidence

66%

Full breach record for One Point HR Solutions, Inc. →

One Point HR Solutions, Inc. reported an external system breach (hacking) affecting 22,885 individuals, including 3 Maine residents. Unauthorized actors accessed email accounts containing names and Social Security numbers between July 3, 2023, and February 14, 2024. The breach was discovered on September 9, 2024. The company engaged forensic specialists, notified law enforcement, and provided 12 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 434 days

discovery → filing · 5 weeks / 32 days

Jul 3, 2023

Begins

Sep 9, 2024

Discovered

Oct 11, 2024

Filed

vs. sector median

14 wks faster

This filing is one of 9 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (8) · sorted by filing gap

New Hampshire State AGbd_0086cc962bc729a62024-10-11Verified
Maine State AGbd_0f6b372b3dd4d5fb2024-09-06 · +35dVerified
New Hampshire State AGbd_20065c46365befff2024-09-06 · +35dVerified
Massachusetts State AGbd_4b9d31a193998e4f2024-09-06 · +35dVerified

Show 4 more filings ↓up to 40d gap

Montana State AGbd_668b3a3ee358d4392024-09-06 · +35dCandidate
Indiana State AGbd_9c03bb465078bfc42024-09-06 · +35dVerified
Vermont State AGbd_546c83680572c5292024-09-05 · +36dVerified
Illinois State AGbd_cdfa4b85eda4e9312024-09-01 · +40dVerified

Name: One Point HR Solutions, Inc.
norm: one point hr
Domain: onepointhrs.com

Name: One Point HR Solutions, Inc.
norm: one point hr
Domain: onepointhrs.com
Industry: Professional Servicesllm

Discovered: Sep 9, 2024
Breach occurred: Jul 3, 2023 – Feb 14, 2024
Undetected for: 434 daysoccurrence → discovery
Materiality determined: —
Notification sent: Sep 6, 2024
Affected individuals: 22,885state + nationwide
Data types: Identity (basic)Government ID
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1114 Email Collection
Threat actor: External
Regulator citations: Notified Maine Attorney GeneralNotified relevant state regulators as necessaryNotified Equifax, Experian, and TransUnion
Initial access: valid_credentials

During the incident: Engaged third-party forensic and data privacy specialists to investigate the nature and scope of the activity
Notified federal and local law enforcement regarding the event
Provided access to credit monitoring services for twelve (12) months through IDX, A ZeroFox Company
Provided impacted individuals with guidance on how to better protect against identity theft and fraud
Provided written notice to relevant state regulators and to the three (3) major credit reporting agencies
Changes made: Implementing additional safeguards and training to its employees
Reviewing existing security policies and implemented additional cybersecurity measures to further protect against similar events moving forward
Reinforced with staff the importance of safeguarding information in their care
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 weeks(32 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 9 filings · 7 states

View merged incident ↗

Illinois State AGSep 1 · first

Vermont State AG+4d

Maine State AG+5d

New Hampshire State AG+5d

Massachusetts State AG+5d

Montana State AG+5d

Indiana State AG+5d

New Hampshire State AG+40d

Maine State AG+40d · this page

Pattern: first filing Sep 1 (IL), last Oct 11 (ME) — a 40-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/7c954292-dd7f-4923-a558-68bad80a7996.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 11, 2024
Raw hash: 3852b8719478d28764ddaddbfd2e88029e30a22296520664821a94bb7229ab5f

Linked disclosures

Regulatory filings (8) · sorted by filing gap

Reporting entityOne Point HR Solutions, Inc.

Victim entityOne Point HR Solutions, Inc.

Incidentdiscovered Sep 9, 2024

Stated responseEngaged third-party forensic and data privacy specialists to investigate the nature and scope of the activity

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov