HackingFinancial ServicesFinanceIdentity (basic)Government IDMediumContained

First Atlantic Capital, Ltd.

bd_f0afccb96e750cbc · schema v1 · pii pii-v1

Severity

Medium

Discovered

Sep 18, 2025

Filed

Jan 30, 2026

To disclose

19 weeks

Affected

Not disclosed

Linked

5 filings

Confidence

68%

Full breach record for First Atlantic Capital, Ltd. →2 incidents on file

First Atlantic Capital, Ltd. notified Vermont consumers of a data security incident discovered on September 18, 2025, involving unauthorized access to computer networks. The company engaged independent cybersecurity experts, secured the network, and offered complimentary credit monitoring and fraud assistance to affected individuals.

J jump to incidentP pin to compareR raw source

Vermont clock✗ VT AG >45 bday19 weeks discovery → filing

⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Incident timeline

discovery → filing · 19 weeks / 134 days

Sep 18, 2025

Begins

Sep 18, 2025

Discovered

Jan 30, 2026

Filed

vs. sector median

+11 wks slower

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Maine State AGbd_49bac84c4f681fa72026-01-30Candidate
Indiana State AGbd_678a16b9c812aa482026-01-30Verified
Nebraska State AGbd_aa28d57e1c60b9872026-01-30Verified
New Hampshire State AGbd_f338d391f5f36b822026-02-02 · +3dVerified

Name: First Atlantic Capital, Ltd.
norm: first atlantic

Name: First Atlantic Capital, Ltd.
norm: first atlantic
Industry: Financial Servicesllm

Discovered: Sep 18, 2025
Breach occurred: Sep 18, 2025
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jan 30, 2026
Affected individuals: Not disclosed
Data types: Identity (basic)Government ID
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: External
Initial access: exploit_public_facing

During the incident: Took immediate steps to secure the network
Initiated an investigation with the assistance of independent cybersecurity experts
Conducted a thorough review of the affected information
Offering you Single Bureau Credit Monitoring/Single Bureau Credit Report/Single Bureau Credit Score services at no charge
Providing you with proactive fraud assistance
Changes made: Implemented measures to enhance security and minimize the risk of a similar incident occurring in the future
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 19 weeks(134 days from discovery to filing)
Compliance flags: VT AG >45 bday
Discovery-date grounding: occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Maine State AGJan 30 · first

Indiana State AGJan 30 · first

Nebraska State AGJan 30 · first

Vermont State AGJan 30 · first · this page

New Hampshire State AG+3d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ago.vermont.gov/document/2026-01-30-first-atlantic-capital-data-breach-notice-consumers
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 30, 2026
Raw hash: 8e7040787e3ef967c7b2c11190cec3be72c4a09c877f06fbc7b0ba0e679ec4eb

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityFirst Atlantic Capital, Ltd.

Victim entityFirst Atlantic Capital, Ltd.

Incidentdiscovered Sep 18, 2025

Stated responseTook immediate steps to secure the network

ComplianceVT AG >45 bday

Extraction provenanceno artifact recorded

Source provenanceago.vermont.gov