HackingOtherData ExfiltratedTargetedIdentity (basic)Government IDMediumContained

Universal Companies, Inc.

bd_c5ed75922bc198b6 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Sep 14, 2024

Filed

May 20, 2025

To disclose

35 weeks

Affected · nationwide

9732 in this filing

Linked

3 records

Confidence

65%

Full breach record for Universal Companies, Inc. →

Universal Companies, Inc. disclosed an external system breach (hacking) on September 14, 2024, affecting 973 individuals. Unauthorized access resulted in the exposure of names, SSNs/TINs, driver's license numbers, and passport numbers. Notices were sent to affected individuals on May 20, 2025, offering 12 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Leak gap clock✗ Leak >180d35 weeks discovery → filing

⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Incident timeline

discovery → filing · 35 weeks / 248 days

Sep 14, 2024

Begins

Sep 14, 2024

Discovered

May 20, 2025

Filed

vs. sector median

+30 wks slower

This filing is one of 3 records about the same incident.View merged incident

A leak claim by play about this victim was first seen 222 days before this filing.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Siteplaybd_8eb8800cb5f117eb2024-09-14 · +248dVerified by operator

Regulatory filings (1) · sorted by filing gap

Indiana State AGbd_611ad2a05982f8a52025-05-20Candidate

Name: Universal Companies, Inc.
norm: universal companies
Domain: universalcompanies.com

Name: Universal Companies, Inc.
norm: universal companies
Domain: universalcompanies.com
Industry: Otherllm

Discovered: Sep 14, 2024
Breach occurred: Sep 14, 2024
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: May 20, 2025
Affected individuals: 973state + nationwide
Data types: Identity (basic)Government ID
Data elements: Social Security number
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Provided written notice of this incident to relevant state regulators
Initial access: exploit_public_facing

During the incident: Took steps to secure its environment
Began an investigation into the nature and scope of the incident
Undertook a comprehensive review of the data
Provided access to credit monitoring services for twelve (12) months through Cyberscout, a TransUnion company
Provided impacted individuals with guidance on how to better protect against identity theft and fraud
Provided written notice of this incident to relevant state regulators
Changes made: Implementing additional safeguards and training to its employees
Implemented additional technical safeguards to help prevent a similar incident in the future
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 35 weeks(248 days from discovery to filing)
Compliance flags: Leak >180dME AG >30d · 248dME resident >60d · 248d
Discovery-date grounding: occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Sep 14, 2024
→ Filed with AG: May 20, 2025
248d 30 days (soft) ME AG >30d
Maine
Discovered: Sep 14, 2024
→ Notified: May 20, 2025
248d 60 days (analyst band; statutory cap is 30 days) ME resident >60d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Sep 14, 2024 → Filed with AG: May 20, 2025	248d	30 days (soft)	ME AG >30d
Maine	Discovered: Sep 14, 2024 → Notified: May 20, 2025	248d	60 days (analyst band; statutory cap is 30 days)	ME resident >60d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Indiana State AGMay 20 · first

Maine State AGMay 20 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/e84ce44a-cb6f-4a1a-85f8-0dbe77363471.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 20, 2025
Raw hash: 84ffed32aff89c3c506fca903befdf1aa85a358c83a115d86f98f17e3e438422

Linked disclosures

Ransomware claims (1)

Regulatory filings (1) · sorted by filing gap

Reporting entityUniversal Companies, Inc.

Victim entityUniversal Companies, Inc.

Incidentdiscovered Sep 14, 2024

Stated responseTook steps to secure its environment

ComplianceLeak >180d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov