HackingFinancial ServicesFinanceSupply Chain (3P Vendor)Data ExfiltratedIdentity (basic)Financial accountFinancial credentialsMedium

Aurora Financial Group, Inc.

bd_d4dba760a6c87a6c · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jun 2, 2022

Filed

Feb 24, 2023

To disclose

38 weeks

Affected · nationwide

3,5481 in this filing

Confidence

66%

Full breach record for Aurora Financial Group, Inc. →3 incidents on file

Aurora Financial Group, Inc. reported a third-party breach that occurred between January 20 and January 22, 2021. The breach was discovered on June 2, 2022, and affected 3,548 individuals. The compromised information included names combined with financial account or card numbers and their associated security codes or PINs. The company offered identity monitoring services from Kroll to affected individuals.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Jun 2, 2022 → Filed with AG Feb 24, 2023267d ✗ ME AG >90d38 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 498 days

discovery → filing · 38 weeks / 267 days

Jan 20, 2021

Begins

Jun 2, 2022

Discovered

Feb 24, 2023

Filed

vs. sector median

+29 wks slower

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed3,548 affectedView incident

Name: Aurora Financial Group, Inc.
norm: aurora financial

Name: Aurora Financial Group, Inc.
norm: aurora financial
Industry: Financial Servicesllm

Discovered: Jun 2, 2022
Breach occurred: Jan 20, 2021 – Jan 22, 2021
Undetected for: 498 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 3,548state + nationwide
Data types: Identity (basic)Financial accountFinancial credentials
Data elements: Financial account number
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain Compromise

During the incident: Sent written notification to affected consumers
Changes made: Offered Kroll identity monitoring services
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 38 weeks(267 days from discovery to filing)
Compliance flags: ME AG >90d · 267d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Jun 2, 2022
→ Filed with AG: Feb 24, 2023
267d 90 days ME AG >90d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Jun 2, 2022 → Filed with AG: Feb 24, 2023	267d	90 days	ME AG >90d

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/dbe8b623-1edb-42c7-8951-6d7124a3e596.shtml
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 24, 2023
Raw hash: bd796a077d0114959e42e5f124e201a5c75b27ea78c664d6e98e0fdd83f54e40

Reporting entityAurora Financial Group, Inc.

Victim entityAurora Financial Group, Inc.

Incidentdiscovered Jun 2, 2022

Stated responseSent written notification to affected consumers

ComplianceME AG >90d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov