DisclosureLens
HackingProfessional ServicesProfessional ServicesCustomer Data InvolvedFinancial accountFinancial credentialsLow

Stevens & Lee, P.C.

bd_c7efad509311ce92 · schema v1 · pii pii-v1

Severity

Low

Discovered

Jun 28, 2021

Filed

Dec 30, 2021

To disclose

26 weeks

Affected · nationwide

3441 in this filing

Linked

9 filings

Confidence

75%
Full breach record for Stevens & Lee, P.C. →

Stevens & Lee, a professional services firm, reported a data breach affecting one Maine resident. The breach, discovered on June 28, 2021, was the result of an external system breach (hacking). The compromised information includes financial account numbers or credit/debit card numbers in combination with security codes, access codes, passwords, or PINs. Affected individuals were notified on December 29, 2021, and offered 12 months of credit and identity monitoring services through IDX.

Maine clockDiscovered Jun 28, 2021 → Filed with AG Dec 30, 2021185d ✗ ME AG >90d26 weeks discovery → filing
⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Incident timeline

discovery → filing · 26 weeks / 185 days

Jun 28, 2021

Begins

Jun 28, 2021

Discovered

Dec 30, 2021

Filed

vs. sector median

+9 wks slower

This filing is one of 9 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (8) · sorted by filing gap

Show 4 more filings ↓up to 102d gap

Filing propagation · 9 filings · 7 states

View merged incident ↗
Maine State AGDec 28 · first
Maine State AG+2d · this page
Massachusetts State AG+6d
Indiana State AG+100d
Montana State AG+100d
Washington State AG+101d
New Hampshire State AG+101d
California State AG+101d
Maine State AG+104d

Pattern: first filing Dec 28 (ME), last Apr 11 (ME) — a 104-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.