HackingTechnologyTransportation & LogisticsInformationCustomer Data InvolvedDelayed DiscoveryIdentity (basic)Government IDMediumActive

LANDSTAR SYSTEM, INC.

bd_ecbaa0d72db8ba88 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Apr 30, 2026

Filed

Jun 11, 2026

To disclose

6 weeks

Affected

23state residents only

Linked

6 filings

Confidence

66%

Full breach record for LANDSTAR SYSTEM, INC. →2 incidents on file

Landstar System Holdings, Inc. reported an external system breach (hacking) in Maine affecting 23 residents. Unauthorized access occurred between April 29-30, 2026, involving name and driver's license data. Landstar blocked access, notified law enforcement, engaged forensic experts, and implemented enhanced authentication. Credit monitoring via TransUnion was offered to affected individuals.

J jump to incidentP pin to compareR raw source

Maine clockScope identified May 22, 2026 → Filed with AG Jun 11, 202620d ✓ ME AG ≤30d6 weeks discovery → filing

Incident timeline

undetected · 1 days

discovery → filing · 6 weeks / 42 days

Apr 29, 2026

Begins

Apr 30, 2026

Discovered

Jun 11, 2026

Filed

vs. sector median

5 wks faster

This filing is one of 6 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

New Hampshire State AGbd_2ab674753f4a98222026-06-11Verified
Massachusetts State AGbd_594465556924da9d2026-06-11Verified
Vermont State AGbd_808662ed62af1abb2026-06-11Verified
Indiana State AGbd_b32e1f41e481e9462026-06-11Verified

Show 1 more filing ↓up to 7d gap

Texas State AGbd_6a1bd42d7cb9838d2026-06-18 · +7dVerified

Name: LANDSTAR SYSTEM, INC.
norm: landstar system

Name: LANDSTAR SYSTEM, INC.
norm: landstar system
Industry: TechnologyllmTransportation & Logisticsllm

Discovered: Apr 30, 2026
Scope identified: May 22, 2026Maine’s notice clock starts here (10 M.R.S. §1348(1))The letter says: “On May 22, 2026, Landstar determined that information related to you was in the data and worked to confirm contact information so we could notify you directly.”
Breach occurred: Apr 29, 2026 – Apr 30, 2026
Undetected for: 1 dayoccurrence → discovery
Materiality determined: —
Notification sent: Jun 11, 2026
Affected individuals: 23state-resident count only
Data types: Identity (basic)Government ID
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1078 Valid Accounts
Threat actor: External
Regulator citations: Landstar is providing written notice of this incident to relevant state regulators, as necessary and as required by law, and to the three major credit reporting agencies, Equifax, Experian, and TransUnion
Initial access: exploit_public_facing

During the incident: Promptly blocked the unauthorized access
Reported the incident to law enforcement
Initiated an investigation to determine the nature and scope of the activity
With the help of outside data security experts, Landstar determined that between April 29, 2026, and April 30, 2026, an unauthorized actor accessed certain applications and storage locations within a limited scope of Landstar’s environment and may have accessed or acquired some data from those systems
Landstar conducted a thorough review of the data to determine if it contained information related to individuals
Landstar notified federal law enforcement regarding the event and is cooperating with their investigation
Landstar is working to implement additional safeguards, including additional cybersecurity training to its employees
Landstar implemented additional security measures, including enhanced authentication protocols
Landstar is providing access to credit monitoring services for twelve (12) months, through TransUnion, to affected individuals whose personal information was potentially affected by this incident, at no cost to these individuals
Changes made: Working to implement additional safeguards, including additional cybersecurity training to its employees
Implemented additional security measures, including enhanced authentication protocols
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 weeks(42 days from discovery to filing)
Compliance flags: ME AG ≤30d · 20d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Scope identified: May 22, 2026
→ Filed with AG: Jun 11, 2026
20d 30 days ME AG ≤30d

Statute	Window	Elapsed	Threshold	Status
Maine	Scope identified: May 22, 2026 → Filed with AG: Jun 11, 2026	20d	30 days	ME AG ≤30d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

New Hampshire State AGJun 11 · first

Massachusetts State AGJun 11 · first

Vermont State AGJun 11 · first

Indiana State AGJun 11 · first

Maine State AGJun 11 · first · this page

Texas State AG+7d

Pattern: first filing Jun 11 (NH), last Jun 18 (TX) — a 7-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/6709a51f-4865-4b2d-9ec2-9c8d9e679d79.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 11, 2026
Raw hash: d145df043482b0a7bd2bbd781bf1ac7dc3733f57404a7f67d4d14d0cb5155122

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityLANDSTAR SYSTEM, INC.

Victim entityLANDSTAR SYSTEM, INC.

Incidentdiscovered Apr 30, 2026

Stated responsePromptly blocked the unauthorized access

ComplianceME AG ≤30d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov