HackingFinancial ServicesFinanceStolen CredentialsSupply Chain (3P Vendor)Customer Data InvolvedData ExfiltratedIdentity (basic)Government IDFinancial accountHighContained

Velocity Risk Underwriters

bd_cf1decc7cfc0f317 · schema v1 · pii pii-v1

Severity

High

Discovered

Apr 28, 2025

Filed

Sep 4, 2025

To disclose

18 weeks

Affected · nationwide

39,31022 in this filing

Linked

8 filings

Confidence

65%

Full breach record for Velocity Risk Underwriters →

Velocity Risk Underwriters, LLC reports a third-party cybersecurity incident involving its prior vendor, WaterStreet Company. Unauthorized access occurred on March 17, 2025, compromising names, financial account information, and SSNs of approximately 39,310 individuals, including 22 Maine residents. WaterStreet implemented remediation measures and provided credit monitoring services.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Apr 28, 2025 → Filed with AG Sep 4, 2025129d ⏱ ME AG >30d18 weeks discovery → filing

Incident timeline

undetected · 42 days

discovery → filing · 18 weeks / 129 days

Mar 17, 2025

Begins

Apr 28, 2025

Discovered

Sep 4, 2025

Filed

vs. sector median

+10 wks slower

This filing is one of 8 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (7) · sorted by filing gap

New Hampshire State AGbd_2fcba4315454f9032025-09-04Verified
Nebraska State AGbd_cb7a3c4f2748829d2025-09-03 · +1dVerified
Indiana State AGbd_640c7bbdabca27cc2025-08-08 · +27dVerified
Texas State AGbd_3228d13e1b7bb9752025-07-28 · +38dVerified by operator

Show 3 more filings ↓up to 42d gap

Massachusetts State AGbd_3f4beb80389d8ba82025-07-25 · +41dVerified
Maine State AGbd_4ab31548e453561c2025-07-25 · +41dVerified
New Hampshire State AGbd_925ef2c1c3de19072025-07-24 · +42dVerified

Name: Wilson, Elser, Moskowitz, Edelman & Dicker LLP
norm: wilson elser moskowitz edelman dicker
Domain: wilsonelser.com

Name: Velocity Risk Underwriters
norm: velocity risk underwriters
Industry: Financial Servicesllm

Discovered: Apr 28, 2025
Breach occurred: Mar 17, 2025
Undetected for: 42 daysoccurrence → discovery
Materiality determined: —
Notification sent: Sep 3, 2025
Affected individuals: 39,310state + nationwide
Data types: Identity (basic)Government IDFinancial account
Data elements: Social Security number
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1078 Valid AccountsT1119 Automated Collection
Threat actor: External
Regulator citations: Filed supplemental notice with Maine Attorney General
Third party: via WaterStreet Company
Initial access: trusted_relationship

During the incident: WaterStreet began a comprehensive investigation into the circumstances involving WaterStreet’s data security incident
WaterStreet launched an investigation and worked with subject matter specialists to determine the nature and scope of the event
WaterStreet shutdown the potentially affected systems
WaterStreet is providing notice to the affected individuals on behalf of Velocity
WaterStreet is offering twelve months of complimentary access to credit monitoring services to all affected individuals
Changes made: Changed/strengthened passwords
Implemented enhanced technical safeguards and security measures
Reviewed and revised existing policies and procedures
Trained or retrained workforce members to further protect against similar incidents moving forward
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 18 weeks(129 days from discovery to filing)
Compliance flags: ME AG >30d · 129dME resident >60d · 128d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Apr 28, 2025
→ Filed with AG: Sep 4, 2025
129d 30 days (soft) ME AG >30d
Maine
Discovered: Apr 28, 2025
→ Notified: Sep 3, 2025
128d 60 days (analyst band; statutory cap is 30 days) ME resident >60d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Apr 28, 2025 → Filed with AG: Sep 4, 2025	129d	30 days (soft)	ME AG >30d
Maine	Discovered: Apr 28, 2025 → Notified: Sep 3, 2025	128d	60 days (analyst band; statutory cap is 30 days)	ME resident >60d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 8 filings · 6 states

View merged incident ↗

New Hampshire State AGJul 24 · first

Massachusetts State AG+1d

Maine State AG+1d

Texas State AG+4d

Indiana State AG+15d

Nebraska State AG+41d

New Hampshire State AG+42d

Maine State AG+42d · this page

Pattern: first filing Jul 24 (NH), last Sep 4 (ME) — a 42-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/b42d85ac-eb21-4a0c-bb88-88dfe9f1c2f6.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 4, 2025
Raw hash: 66e0927032cc34001d803b19374a4e8fe682564910c53e7296075ddee1c36cd0

Linked disclosures

Regulatory filings (7) · sorted by filing gap

Reporting entityWilson, Elser, Moskowitz, Edelman & Dicker LLP

Victim entityVelocity Risk Underwriters

Incidentdiscovered Apr 28, 2025

Stated responseWaterStreet began a comprehensive investigation into the circumstances involving WaterStreet’s data security incident

ComplianceME AG >30d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov