HackingGovernmentGovernmentCustomer Data InvolvedTargetedIdentity (basic)Government IDHighContained

Town of Bedford

bd_e067d4e68b10fb64 · schema v1 · pii pii-v1

Severity

High

Discovered

Nov 19, 2024

Filed

May 29, 2025

To disclose

27 weeks

Affected · nationwide

1,4793 in this filing

Linked

3 filings

Confidence

66%

Full breach record for Town of Bedford →

Town of Bedford (MA) reported an external system breach (hacking) of its email system on July 30, 2024, discovered on November 19, 2024. The incident compromised names and Social Security numbers of 1,479 individuals, including 3 Maine residents. Notices were sent on May 23, 2025, offering 12 months of credit monitoring via TransUnion/Cyberscout.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Nov 19, 2024 → Filed with AG May 29, 2025191d ✗ ME AG >90d27 weeks discovery → filing

Incident timeline

undetected · 112 days

discovery → filing · 27 weeks / 191 days

Jul 30, 2024

Begins

Nov 19, 2024

Discovered

May 29, 2025

Filed

This filing is one of 3 about the same incident.View merged incident

A leak claim by qilin about this victim predates this filing by 191 days.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (2)

Leak Siteqilinbd_cb5ef08d38cb9cdb2025-03-28 · +62dVerified
Leak Siteqilinbd_ed59df9da3558c7d2024-11-19 · +191dVerified

Name: Town of Bedford
norm: town of bedford
Domain: bedfordma.gov

Name: Town of Bedford
norm: town of bedford
Domain: bedfordma.gov
Industry: Governmentllm

Discovered: Nov 19, 2024
Breach occurred: Jul 30, 2024
Undetected for: 112 daysoccurrence → discovery
Materiality determined: —
Notification sent: May 23, 2025
Affected individuals: 1,479state + nationwide
Data types: Identity (basic)Government ID
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1078 Valid Accounts
Threat actor: External
Regulator citations: Collaborated with law enforcement
Initial access: exploit_public_facing

During the incident: Secured and remediated the compromise
Engaged additional third-party experts
Hardened and enhanced data security
Commenced an investigation
Collaborated with law enforcement
Changes made: Hardened and enhanced data security
Continuous awareness training and assessment of data security
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 27 weeks(191 days from discovery to filing)
Compliance flags: ME AG >90d · 191dME resident >180d · 185dLeak >180d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Nov 19, 2024
→ Filed with AG: May 29, 2025
191d 90 days ME AG >90d
Maine
Discovered: Nov 19, 2024
→ Notified: May 23, 2025
185d 180 days ME resident >180d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Nov 19, 2024 → Filed with AG: May 29, 2025	191d	90 days	ME AG >90d
Maine	Discovered: Nov 19, 2024 → Notified: May 23, 2025	185d	180 days	ME resident >180d

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/a3b5d883-ea77-461d-b994-68887917164c.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 29, 2025
Raw hash: be798c3c46474fdc769d430615e3a46a81617c1866b13a24947386b95453133c

Linked disclosures

Ransomware claims (2)

Reporting entityTown of Bedford

Victim entityTown of Bedford

Incidentdiscovered Nov 19, 2024

Stated responseSecured and remediated the compromise

ComplianceME AG >90d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov