DisclosureLens
HackingRetail & ConsumerHospitalityRetailCustomer Data InvolvedIdentity (basic)Financial accountFinancial credentialsMediumResolved

Great Smoky Mountains Association

bd_e47f4e45b6198cf5 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Mar 17, 2022

Filed

Jun 23, 2022

To disclose

14 weeks

Affected · nationwide

2,8628 in this filing

Linked

5 filings

Confidence

50%
Full breach record for Great Smoky Mountains Association

Great Smoky Mountains Association, a non-profit organization, reported a data breach affecting 8 Maine residents. The breach was a result of an external system hacking incident that occurred between May 21, 2021, and December 18, 2021. The breach was discovered on March 17, 2022. The compromised information includes names in combination with financial account numbers or credit/debit card numbers and their security codes. Affected consumers were notified in writing on June 23, 2022. Identity theft protection services were not offered.

Maine clockDiscovered Mar 17, 2022Filed with AG Jun 23, 202298d ME AG >90d14 weeks discovery → filing
AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 300 days
discovery → filing · 14 weeks / 98 days

May 21, 2021

Begins

Mar 17, 2022

Discovered

Jun 23, 2022

Filed

vs. sector median

+6 wks slower

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Filing propagation · 5 filings · 5 states

View merged incident ↗
Massachusetts State AGJun 23 · first
Montana State AGJun 23 · first
Indiana State AGJun 23 · first
Washington State AGJun 23 · first
Maine State AGJun 23 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.