HackingFinancial ServicesFinanceCustomer Data InvolvedIdentity (basic)Government IDHighContained

Industrial Acceptance Corporation

bd_db8fcb8b8729724b · schema v1 · pii pii-v1

Severity

High

Discovered

Feb 24, 2025

Filed

May 29, 2026

To disclose

15 months

Affected · nationwide

79,216226 in this filing

Linked

11 filings

Confidence

65%

Full breach record for Industrial Acceptance Corporation →

Industrial Acceptance Corporation, a financial services entity based in New Haven, CT, reported an external system breach (hacking) occurring on February 22, 2025, discovered on February 24, 2025. The incident affected 79,216 individuals, including 226 Maine residents. The breach involved the acquisition of personal identifiers and government IDs. The company provided written notification and offered 12 months of identity monitoring services through CyberSteward (TransUnion).

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Feb 24, 2025 → Filed with AG May 29, 2026459d ✗ ME AG >90d15 months discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 2 days

discovery → filing · 15 months / 459 days

Feb 22, 2025

Begins

Feb 24, 2025

Discovered

May 29, 2026

Filed

vs. sector median

+57 wks slower

This filing is one of 11 about the same incident.View merged incident

A leak claim by akira about this victim predates this filing by 456 days.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Siteakirabd_09c40eae3676c1962025-02-27 · +456dCandidate

Regulatory filings (9) · sorted by filing gap

Texas State AGbd_79cfa0ac16eea4542026-05-29Verified
Massachusetts State AGbd_b48acdbe47a03a882026-05-29Verified
Nebraska State AGbd_5744e8fd9f6330db2026-05-28 · +1dVerified
California State AGbd_64f9be54f5cdd9c62026-05-28 · +1dVerified

Show 5 more filings ↓up to 28d gap

New Hampshire State AGbd_aa16cbe2fb05315d2026-05-28 · +1dVerified
Indiana State AGbd_ab7b0ef963d42cb72026-05-28 · +1dVerified
Washington State AGbd_8f552868d4b217252026-06-01 · +3dVerified
Vermont State AGbd_95d220c931e3ba952026-06-01 · +3dVerified
Illinois State AGbd_1406d214a2334d6b2026-05-01 · +28dCandidate

Name: Industrial Acceptance Corporation
norm: industrial acceptance
Domain: iaccredit.com
Industry: Financial Services

Name: Industrial Acceptance Corporation
norm: industrial acceptance
Domain: iaccredit.com
Industry: Financial Services
Industry: Financial Servicesllm

Discovered: Feb 24, 2025
Breach occurred: Feb 22, 2025
Undetected for: 2 daysoccurrence → discovery
Materiality determined: —
Notification sent: May 28, 2026
Affected individuals: 79,216state + nationwide
Data types: Identity (basic)Government ID
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: External
Initial access: exploit_public_facing

During the incident: Sent written notification to affected individuals
Offered 12M of identity monitoring services through CyberSteward, a TransUnion company
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 15 months(459 days from discovery to filing)
Compliance flags: ME AG >90d · 459dME resident >180d · 458dLeak >180d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Feb 24, 2025
→ Filed with AG: May 29, 2026
459d 90 days ME AG >90d
Maine
Discovered: Feb 24, 2025
→ Notified: May 28, 2026
458d 180 days ME resident >180d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Feb 24, 2025 → Filed with AG: May 29, 2026	459d	90 days	ME AG >90d
Maine	Discovered: Feb 24, 2025 → Notified: May 28, 2026	458d	180 days	ME resident >180d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 10 filings · 10 states

View merged incident ↗

Illinois State AGMay 1 · first

Nebraska State AG+27d

California State AG+27d

New Hampshire State AG+27d

Indiana State AG+27d

Texas State AG+28d

Massachusetts State AG+28d

Maine State AG+28d · this page

Washington State AG+31d

Vermont State AG+31d

Pattern: first filing May 1 (IL), last Jun 1 (VT) — a 31-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/c2a95af1-d639-45ab-ab0d-8dbefca3f72a.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 29, 2026
Raw hash: b54f375c32864bd5aed75bbc28fad3772aa8f718f56d540695c556efe7a49881

Linked disclosures

Ransomware claims (1)

Regulatory filings (9) · sorted by filing gap

Reporting entityIndustrial Acceptance Corporation

Victim entityIndustrial Acceptance Corporation

Incidentdiscovered Feb 24, 2025

Stated responseSent written notification to affected individuals

ComplianceME AG >90d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov