HackingOtherData ExfiltratedCustomer Data InvolvedDelayed DiscoveryPIIPHIFINANCIALIDENTITY_GOVERNMENTMediumContained
Oxford Companies
bd_d5c7e0e1d87fb75c · schema v1 · pii pii-v1
Full breach record for Oxford Companies →Oxford Companies (property management, Ann Arbor MI) discovered unauthorized network access on Feb 10, 2025. Incident window: Oct 17, 2023 – Feb 12, 2025. Forensic investigation confirmed unauthorized actor accessed files. Data exposed: names, DOBs, medical reference numbers, banking info, SSNs. 559 total affected; 1 Maine resident. Notifications mailed Jan 26, 2026. Oxford offered 12 months free credit monitoring via Cyberscout.
Maine clockDiscovered Feb 10, 2025 → Filed with AG Jan 27, 2026351d ✗ ME AG >90d50 weeks discovery → filing
⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
This filing is one of 2 about the same incident.View merged incident
A leak claim by play about this victim predates this filing by 357 days.View originating leak claim
Linked disclosures
Why this link?Ransomware claims (1)
- bd_e1cb84c7bef643adLeak Siteplayfiled 2025-02-04(357d gap)Verified
Source provenance
- Source URL
- https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/de06fef6-276c-4698-8f6e-2cfa6ac9333b.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Jan 27, 2026
- Raw hash
- 186c8f1529d2ddd4aac06a2334549e21dd6becca03c64ded02d313bc47318ddc
Reporting entity
- Name
- Oxford Companiesnorm: oxford companies
- Domain
- oxfordcompanies.com
- Industry
- Property Management and Real Estate Investment
Victim entity
- Name
- Oxford Companiesnorm: oxford companies
- Domain
- oxfordcompanies.com
- Industry
- Property Management and Real Estate Investment
- Industry
- Otherllm
Incident
- Discovered
- Feb 10, 2025
- Materiality determined
- —
- Notification sent
- Jan 26, 2026
- Affected individuals
- 1
- Data types
- PIIPHIFINANCIALIDENTITY_GOVERNMENT
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1078 Valid Accounts
- Threat actor
- External
- Regulator citations
- Maine Attorney General
Compliance
- Time to disclose
- 50 weeks(351 days from discovery to filing)
- Compliance flags
- ME AG >90d · 351dME resident >180d · 350dLeak >180d
- Discovery-date grounding
- unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
- Clock breakdown
Statute Window Elapsed Threshold Status Maine Discovered: Feb 10, 2025→ Filed with AG: Jan 27, 2026351d 90 days ME AG >90d Maine Discovered: Feb 10, 2025→ Notified: Jan 26, 2026350d 180 days ME resident >180d
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.