DisclosureLens
HackingTechnologyInformationHacking OtherIdentity (basic)Financial accountFinancial credentialsLowContained

CORE Cashless

bd_e47a3e5e6cdd7f83 · schema v1 · pii pii-v1

Severity

Low

Discovered

Jul 28, 2022

Filed

Sep 13, 2022

To disclose

7 weeks

Affected

Not disclosed

Linked

5 filings

Confidence

50%
Full breach record for CORE Cashless →2 incidents on file

CORE Cashless, LLC, a point-of-sale (POS) vendor, reported an external system breach that occurred on January 29, 2022. The incident was discovered on July 28, 2022. The compromised data includes names or other personal identifiers in combination with financial account numbers or credit/debit card numbers, along with their security codes, access codes, passwords, or PINs. The company notified affected consumers electronically on November 1, 2022, and offered 12 months of single-bureau credit monitoring, fraud consultation, and identity theft restoration services. The total number of affected individuals, including Maine residents, was not disclosed.

Maine clockDiscovered Jul 28, 2022 → Filed with AG Sep 13, 202247d ⏱ ME AG >30d7 weeks discovery → filing
⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 180 days
discovery → filing · 7 weeks / 47 days

Jan 29, 2022

Begins

Jul 28, 2022

Discovered

Sep 13, 2022

Filed

vs. sector median

12 wks faster

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Filing propagation · 5 filings · 5 states

View merged incident ↗
Delaware State AGJul 28 · first
South Carolina State AG+43d
California State AG+47d
Maine State AG+47d · this page
Massachusetts State AG+48d

Pattern: first filing Jul 28 (DE), last Sep 14 (MA) — a 48-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.