HackingVulnerability ExploitData ExfiltratedTargetedIDENTITY_GOVERNMENTIDENTITY_BASICCriticalContained
State of Maine
bd_c6058d3ab49a2b3c · schema v1 · pii pii-v1
Full breach record for State of Maine →The State of Maine reported a breach of its external systems caused by a vulnerability in MOVEit software. The incident occurred May 28-29, 2023, and was discovered on May 31, 2023. The breach affected 1,324,118 individuals nationwide, including 534,194 Maine residents. Compromised data included names and driver's license numbers. Notification was provided via substitute notice on November 9, 2023, with two years of identity protection services offered.
Maine clockDiscovered May 31, 2023 → Filed with AG Nov 9, 2023162d ✗ ME AG >90d23 weeks discovery → filing
⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.
This filing is one of 8 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (7) · sorted by filing gap
- bd_3234f2a5a49275f0Vermont State AGfiled 2023-11-09Verified
- bd_bb9048f3d846f18fMontana State AGfiled 2023-11-09Verified
- bd_54ab15a9f1f46a49Washington State AGfiled 2023-11-13(4d gap)Verified
- bd_0c414cef662e480bNew Hampshire State AGfiled 2023-11-15(6d gap)Verified
Show 3 more filings ↓Show fewer ↑up to 18d gap
- bd_9fdd1746eaefe173HHS OCRfiled 2023-11-16(7d gap)Verified
- bd_9f3c12779b714b64California State AGfiled 2023-11-27(18d gap)Verified
- bd_d9f19ada2e1cd45aOregon State AGfiled 2023-11-27(18d gap)Verified
Source provenance
- Source URL
- https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/28acf6fd-b31d-427f-9988-1edb8ee5fda2.shtml
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Nov 9, 2023
- Raw hash
- c7fd90fc157c263c8fc23b5369e36f4eae0d13a37f501c258f2046413b105232
Reporting entity
- Name
- State of Mainenorm: state of maine
- Industry
- government_public
Victim entity
- Name
- State of Mainenorm: state of maine
- Industry
- government_public
Incident
- Discovered
- May 31, 2023
- Materiality determined
- —
- Notification sent
- Nov 9, 2023
- Affected individuals
- 1,324,118
- Data types
- IDENTITY_GOVERNMENTIDENTITY_BASIC
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 Channel
- Threat actor
- ExternalFinancial
- Initial access
- exploit_public_facing
Compliance
- Time to disclose
- 23 weeks(162 days from discovery to filing)
- Compliance flags
- ME AG >90d · 162dME resident >60d · 162d
- Discovery-date grounding
- AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.
- Clock breakdown
Statute Window Elapsed Threshold Status Maine Discovered: May 31, 2023→ Filed with AG: Nov 9, 2023162d 90 days ME AG >90d Maine Discovered: May 31, 2023→ Notified: Nov 9, 2023162d 60 days (analyst band; statutory cap is 30 days) ME resident >60d
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.