HackingRetail & ConsumerRetailData ExfiltratedCustomer Data InvolvedDelayed DiscoveryPIIIDENTITY_GOVERNMENTIDENTITY_BASICMediumContained
Mullinax Automotive
bd_c83728dba52741b6 · schema v1 · pii pii-v1
Full breach record for Mullinax Automotive →Mullinax Automotive d/b/a Mullinax Ford of Central Florida reported an external system breach in which an unauthorized actor accessed and copied data from Mullinax systems between December 4 and December 25, 2025. The breach was discovered on March 18, 2026 after a forensic review. Affected data includes names, Social Security numbers, and driver's license numbers. Two Maine residents were notified on April 15, 2026. Kroll identity monitoring (24 months) was offered.
Maine clockDiscovered Mar 18, 2026 → Filed with AG Apr 15, 202628d ✓ ME AG ≤30d28 days discovery → filing
⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed2 affectedView incident
Source provenance
- Source URL
- https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/7b8676df-0894-41b3-9fe0-d0a2d7b81f5b.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Apr 15, 2026
- Raw hash
- 1da38f676aecff88874108c760925cd8ff8cbd55c25f101427358801cc498714
Reporting entity
- Name
- Mullinax Automotivenorm: mullinax automotive
- Domain
- mullinaxford.com
- Industry
- Other Commercial
Victim entity
- Name
- Mullinax Automotivenorm: mullinax automotive
- Domain
- mullinaxford.com
- Industry
- Other Commercial
- Industry
- Retail & Consumerllm
Incident
- Discovered
- Mar 18, 2026
- Materiality determined
- Mar 18, 2026
- Notification sent
- Apr 15, 2026
- Affected individuals
- 2
- Data types
- PIIIDENTITY_GOVERNMENTIDENTITY_BASIC
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1078 Valid AccountsT1041 Exfiltration Over C2 Channel
- Threat actor
- External
- Regulator citations
- Notified Maine Attorney GeneralNotified federal law enforcement
Compliance
- Time to disclose
- 28 days(28 days from discovery to filing)
- Compliance flags
- ME AG ≤30d · 28d
- Discovery-date grounding
- unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
- Clock breakdown
Statute Window Elapsed Threshold Status Maine Discovered: Mar 18, 2026→ Filed with AG: Apr 15, 202628d 30 days ME AG ≤30d
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.