HackingTechnologyInformationCustomer Data InvolvedIdentity (basic)Government IDHighResolved

Thybar Corporation

bd_dfcaf5bfa129c6db · schema v1 · pii pii-v1

Severity

High

Discovered

Oct 4, 2021

Filed

Feb 22, 2022

To disclose

20 weeks

Affected · nationwide

1,6731 in this filing

Linked

2 filings

Confidence

65%

Full breach record for Thybar Corporation →2 incidents on file

Thybar Corporation reported an external system breach (hacking) occurring between August 20 and October 5, 2021. The incident compromised names and Social Security Numbers of 1,673 individuals, including one Maine resident. Thybar notified affected individuals in writing on February 22, 2022, and provided 12 months of credit monitoring and identity theft protection services through IDX.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Oct 4, 2021 → Filed with AG Feb 22, 2022141d ✗ ME AG >90d20 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 45 days

discovery → filing · 20 weeks / 141 days

Aug 20, 2021

Begins

Oct 4, 2021

Discovered

Feb 22, 2022

Filed

vs. sector median

+2 wks slower

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Massachusetts State AGbd_58b1a190712894d82022-02-23 · +1dVerified

Name: Thybar Corporation
norm: thybar

Name: Thybar Corporation
norm: thybar
Industry: Technologyllm

Discovered: Oct 4, 2021
Breach occurred: Aug 20, 2021 – Oct 5, 2021
Undetected for: 45 daysoccurrence → discovery
Materiality determined: —
Notification sent: Feb 22, 2022
Affected individuals: 1,673state + nationwide
Data types: Identity (basic)Government ID
Data elements: Social Security number
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Filed notification with Maine Attorney General
Initial access: exploit_public_facing

During the incident: Offered 12 months of complimentary credit monitoring and identity theft protection through IDX
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 20 weeks(141 days from discovery to filing)
Compliance flags: ME AG >90d · 141dME resident >60d · 141d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Oct 4, 2021
→ Filed with AG: Feb 22, 2022
141d 90 days ME AG >90d
Maine
Discovered: Oct 4, 2021
→ Notified: Feb 22, 2022
141d 60 days (analyst band; statutory cap is 30 days) ME resident >60d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Oct 4, 2021 → Filed with AG: Feb 22, 2022	141d	90 days	ME AG >90d
Maine	Discovered: Oct 4, 2021 → Notified: Feb 22, 2022	141d	60 days (analyst band; statutory cap is 30 days)	ME resident >60d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Maine State AGFeb 22 · first · this page

Massachusetts State AG+1d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/2eed6bef-52d5-4f99-b9eb-500d6d2e766e.shtml
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 22, 2022
Raw hash: 2551483474683fd1328b62ce1e918b1a4705f6712cb566aa3cf8ac7b4c884020

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityThybar Corporation

Victim entityThybar Corporation

Incidentdiscovered Oct 4, 2021

Stated responseOffered 12 months of complimentary credit monitoring and identity theft protection through IDX

ComplianceME AG >90d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov