Passco Companies, LLC
bd_c87ddaa00b61303c · schema v1 · pii pii-v1
Full breach record for Passco Companies, LLC →Passco Companies, LLC, a technology services provider based in Irvine, CA, reported a supplemental data breach notice to the Maine Attorney General. The incident involved unauthorized access to systems on August 7, 2025, discovered on December 16, 2025. The breach affected 8,335 individuals total, including 12 Maine residents. Data exposed included names, Social Security numbers, driver's license numbers, and financial account information. Passco engaged forensic specialists, provided 12 months of credit monitoring via Experian, and notified state regulators and credit bureaus. The investigation is ongoing.
Linked disclosures
Why this link?Regulatory filings (7) · sorted by filing gap
- bd_52fb8e40aac6b38aVermont State AGfiled 2026-06-11Verified
- bd_62c3b03bcfb5efb9New Hampshire State AGfiled 2026-06-11Verified
- bd_b6b6073a7314588bTexas State AGfiled 2026-06-18(7d gap)Verified
- bd_028002b51934966cVermont State AGfiled 2026-04-17(55d gap)Candidate
Show 3 more filings ↓Show fewer ↑up to 55d gap
- bd_4bbf14e265b33cefIndiana State AGfiled 2026-04-17(55d gap)Candidate
- bd_c24d94eecd655d37New Hampshire State AGfiled 2026-04-17(55d gap)Verified
- bd_c49c41e887779faaMaine State AGfiled 2026-04-17(55d gap)Verified by operator
Source provenance
- Source URL
- https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/80f6054c-b2da-4fee-b395-ed990a23f778.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Jun 11, 2026
- Raw hash
- a0d3b3aca84f10480214035c19b9aa555ac531d17d93fdfa88a10ab3461fdb37
Reporting entity
- Name
- Passco Companies, LLCnorm: passco companies
- Domain
- passco.com
Victim entity
- Name
- Passco Companies, LLCnorm: passco companies
- Domain
- passco.com
Incident
- Discovered
- Dec 16, 2025
- Materiality determined
- —
- Notification sent
- Jun 11, 2026
- Affected individuals
- 8,335
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENTFINANCIAL_ACCOUNT
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1190 Exploit Public-Facing Application
- Threat actor
- External
- Regulator citations
- Provided written notice of this incident to relevant state regulators, as necessary
- Initial access
- exploit_public_facing
Compliance
- Time to disclose
- 25 weeks(177 days from discovery to filing)
- Compliance flags
- ME AG >90d · 177dME resident >60d · 177d
- Discovery-date grounding
- AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.
- Clock breakdown
Statute Window Elapsed Threshold Status Maine Discovered: Dec 16, 2025→ Filed with AG: Jun 11, 2026177d 90 days ME AG >90d Maine Discovered: Dec 16, 2025→ Notified: Jun 11, 2026177d 60 days (analyst band; statutory cap is 30 days) ME resident >60d
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.