HackingOtherVulnerability ExploitZero-DayTargetedCustomer Data InvolvedIdentity (basic)LowContained

DC Safety Sales Co., Inc.

bd_e513f5d8667a98c5 · schema v1 · pii pii-v1

Severity

Low

Discovered

May 2, 2025

Filed

May 28, 2025

To disclose

26 days

Affected · nationwide

1164 in this filing

Confidence

66%

Full breach record for DC Safety Sales Co., Inc. →

DC Safety Sales Co., Inc. reported an external system breach (hacking) exploiting a zero-day vulnerability in a third-party application. The incident occurred between Dec 11, 2024, and Jan 22, 2025, and was discovered on May 2, 2025. 116 individuals were affected, including 4 Maine residents. Data involved names and other personal identifiers. Remediation included isolating servers, engaging third-party specialists, and offering 24 months of Experian credit monitoring.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered May 2, 2025 → Filed with AG May 28, 202526d ✓ ME AG ≤30d26 days discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 142 days

discovery → filing · 26 days

Dec 11, 2024

Begins

May 2, 2025

Discovered

May 28, 2025

Filed

vs. sector median

4 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed116 affectedView incident

Name: Cipriani & Werner
norm: cipriani werner
Domain: c-wlaw.com

Name: DC Safety Sales Co., Inc.
norm: dc safety sales
Industry: Otherllm

Discovered: May 2, 2025
Breach occurred: Dec 11, 2024 – Jan 22, 2025
Undetected for: 142 daysoccurrence → discovery
Materiality determined: —
Notification sent: May 28, 2025
Affected individuals: 116state + nationwide
Data types: Identity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1078 Valid Accounts
Threat actor: External
Regulator citations: Notifying requisite regulatory authorities
Initial access: exploit_public_facing

During the incident: Isolated the servers
Conducted an investigation
Working with third-party specialists
Undertook a comprehensive review to determine the content of the potentially accessed data
Notifying requisite regulatory authorities
Arranged for you to enroll, at no cost to you, in an online credit monitoring service for 24 months provided by Experian
Changes made: Addressed the vulnerability in the third-party application
Enhance the security of our network to prevent similar incidents from occurring in the future
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 26 days(26 days from discovery to filing)
Compliance flags: ME AG ≤30d · 26d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: May 2, 2025
→ Filed with AG: May 28, 2025
26d 30 days ME AG ≤30d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: May 2, 2025 → Filed with AG: May 28, 2025	26d	30 days	ME AG ≤30d

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/78796fc8-38c3-4f7a-9eff-c900c72f821e.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 28, 2025
Raw hash: db97a3b1a26d04385d86e7605bd2ec662510cfab4d355ffef61cdf66e75d9ade

Reporting entityCipriani & Werner

Victim entityDC Safety Sales Co., Inc.

Incidentdiscovered May 2, 2025

Stated responseIsolated the servers

ComplianceME AG ≤30d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov