HackingGovernmentGovernmentCustomer Data InvolvedIdentity (basic)Government IDHighContained

Gaines County, Texas

bd_dd69125c43f99f0d · schema v1 · pii pii-v1

Severity

High

Discovered

Feb 19, 2025

Filed

May 22, 2025

To disclose

5 weeks

Affected · nationwide

3,1601 in this filing

Linked

3 filings

Confidence

66%

Full breach record for Gaines County, Texas →

Gaines County, Texas, reported an external system breach (hacking) on February 19, 2025, discovered on April 14, 2025. The incident affected 3,160 individuals, including 1 Maine resident. Compromised data included names, dates of birth, and Social Security numbers. The County engaged forensic experts, notified affected individuals on May 20, 2025, and offered 12 months of credit monitoring and identity protection services.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Feb 19, 2025 → Filed with AG May 22, 202592d ✗ ME AG >90d5 weeks discovery → filing

Incident timeline

discovery → filing · 13 weeks / 92 days

Feb 19, 2025

Begins

Feb 19, 2025

Discovered

May 22, 2025

Filed

vs. sector median

5 wks faster

This filing is one of 3 about the same incident.View merged incident

A leak claim by qilin about this victim predates this filing by 92 days.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (2)

Leak Siteqilinbd_5a85be939dbf0b7d2025-02-20 · +91dVerified
Leak Siteqilinbd_1c93af73e2ded0be2025-02-19 · +92dVerified

Name: Constangy, Brooks, Smith & Prophete, LLP
norm: constangy brooks smith prophete

Name: Gaines County, Texas
norm: gaines county texas
Domain: gaines.tx.us
Industry: Governmentllm

Discovered: Feb 19, 2025
Breach occurred: Feb 19, 2025
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: May 20, 2025
Affected individuals: 3,160state + nationwide
Data types: Identity (basic)Government ID
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: ExternalFinancial
Regulator citations: Notified Maine Attorney General
Initial access: exploit_public_facing

During the incident: Initiated an investigation with the assistance of independent forensic experts
Engaged an independent team to perform a comprehensive review of all data involved
Provided individuals with information about steps that they can take to help protect their personal information
Offering individuals complimentary identity protection services
Providing a dedicated call center to address any questions that individuals may have relating to the incident
Implemented additional technical security measures throughout the environment
Changes made: Implemented additional technical security measures throughout the environment
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 weeks(38 days from discovery to filing)
Compliance flags: ME AG >90d · 92dME resident >60d · 90dLeak >90d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Feb 19, 2025
→ Filed with AG: May 22, 2025
92d 90 days ME AG >90d
Maine
Discovered: Feb 19, 2025
→ Notified: May 20, 2025
90d 60 days (analyst band; statutory cap is 30 days) ME resident >60d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Feb 19, 2025 → Filed with AG: May 22, 2025	92d	90 days	ME AG >90d
Maine	Discovered: Feb 19, 2025 → Notified: May 20, 2025	90d	60 days (analyst band; statutory cap is 30 days)	ME resident >60d

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/52a89aef-a309-45a5-8ea8-61f11538a74d.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 22, 2025
Raw hash: d483669aabf9023ed344286fdca13aaf30bdee6ea345fb454b0f54e64bc7d3b9

Linked disclosures

Ransomware claims (2)

Reporting entityConstangy, Brooks, Smith & Prophete, LLP

Victim entityGaines County, Texas

Incidentdiscovered Feb 19, 2025

Stated responseInitiated an investigation with the assistance of independent forensic experts

ComplianceME AG >90d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov