HackingRetail & ConsumerRetailCustomer Data InvolvedPIIGovernment IDHighContained

ANDREWS MCMEEL UNIVERSAL

bd_ea47cf7ddeffad26 · schema v1 · pii pii-v1

Severity

High

Discovered

Jan 4, 2023

Filed

Jan 23, 2023

To disclose

19 days

Affected · nationwide

1,2675 in this filing

Linked

7 filings

Confidence

66%

Full breach record for ANDREWS MCMEEL UNIVERSAL →2 incidents on file

Andrews McMeel Universal reported an external system breach (hacking) occurring on November 17, 2022, discovered on January 4, 2023. The incident compromised names and Social Security Numbers of 1,267 individuals, including 5 Maine residents. The company provided written notification and offered 12 months of credit monitoring services through IDX.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Jan 4, 2023 → Filed with AG Jan 23, 202319d ✓ ME AG ≤30d19 days discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 48 days

discovery → filing · 19 days

Nov 17, 2022

Begins

Jan 4, 2023

Discovered

Jan 23, 2023

Filed

vs. sector median

5 wks faster

This filing is one of 7 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (6) · sorted by filing gap

Massachusetts State AGbd_67bdf8d2898d18272023-01-25 · +2dVerified
New Hampshire State AGbd_964ef63b17930bd42023-01-25 · +2dVerified
Indiana State AGbd_acc7e6d405cf3c8a2023-01-25 · +2dVerified
New Hampshire State AGbd_8a181b57cb17b4862023-03-22 · +58dVerified

Show 2 more filings ↓up to 58d gap

Montana State AGbd_8cdbc5d9f8ed62f62023-03-22 · +58dVerified
Maine State AGbd_e6d12835c087df6f2023-03-22 · +58dVerified

Name: ANDREWS MCMEEL UNIVERSAL
norm: andrews mcmeel universal

Name: ANDREWS MCMEEL UNIVERSAL
norm: andrews mcmeel universal
Industry: Retail & Consumerllm

Discovered: Jan 4, 2023
Breach occurred: Nov 17, 2022
Undetected for: 48 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jan 25, 2023
Affected individuals: 1,267state + nationwide
Data types: PIIGovernment ID
Data elements: Social Security number
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: External
Initial access: exploit_public_facing

During the incident: Sent written notification to affected individuals
Offered 12 months of credit monitoring through IDX
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 19 days(19 days from discovery to filing)
Compliance flags: ME AG ≤30d · 19d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Jan 4, 2023
→ Filed with AG: Jan 23, 2023
19d 30 days ME AG ≤30d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Jan 4, 2023 → Filed with AG: Jan 23, 2023	19d	30 days	ME AG ≤30d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 7 filings · 5 states

View merged incident ↗

Maine State AGJan 23 · first · this page

Massachusetts State AG+2d

New Hampshire State AG+2d

Indiana State AG+2d

New Hampshire State AG+58d

Montana State AG+58d

Maine State AG+58d

Pattern: first filing Jan 23 (ME), last Mar 22 (ME) — a 58-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/00f7f63f-7b99-462c-8b18-fad916bdbb66.shtml
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 23, 2023
Raw hash: dc10bc1fd166c616786adbc36a45c757d474ec2cf5fcd787e562b7e5cc09fc00

Linked disclosures

Regulatory filings (6) · sorted by filing gap

Reporting entityANDREWS MCMEEL UNIVERSAL

Victim entityANDREWS MCMEEL UNIVERSAL

Incidentdiscovered Jan 4, 2023

Stated responseSent written notification to affected individuals

ComplianceME AG ≤30d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov