HackingTechnologyInformationStolen CredentialsData ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDMediumContained

Aero Simulation, Inc.

bd_f156e555a7c447b1 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Feb 27, 2024

Filed

Oct 10, 2024

To disclose

32 weeks

Affected · nationwide

5701 in this filing

Confidence

65%

Full breach record for Aero Simulation, Inc. →

Aero Simulation, Inc. reported an external system breach (hacking) affecting one employee email account. Unauthorized access occurred between Feb 1 and May 31, 2023, and was discovered on Feb 27, 2024. Data potentially exposed included names and Social Security numbers. 570 individuals were affected, including 1 Maine resident. Notices were sent on Oct 10, 2024, offering 12 months of credit monitoring via Kroll.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Feb 27, 2024 → Filed with AG Oct 10, 2024226d ⏱ ME AG >30d32 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 391 days

discovery → filing · 32 weeks / 226 days

Feb 1, 2023

Begins

Feb 27, 2024

Discovered

Oct 10, 2024

Filed

vs. sector median

+21 wks slower

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed570 affectedView incident

Name: Aero Simulation, Inc.
norm: aero simulation
Domain: aerosimulation.com

Name: Aero Simulation, Inc.
norm: aero simulation
Domain: aerosimulation.com
Industry: Technologyllm

Discovered: Feb 27, 2024
Breach occurred: Feb 1, 2023 – May 31, 2023
Undetected for: 391 daysoccurrence → discovery
Materiality determined: —
Notification sent: Oct 10, 2024
Affected individuals: 570state + nationwide
Data types: Identity (basic)Government ID
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1114 Email Collection
Threat actor: External
Regulator citations: Providing written notice of this incident to relevant state regulators, as necessary
Initial access: valid_credentials

During the incident: Took steps to secure the email account
Launched an extensive investigation with the assistance of third-party forensic specialists
Began notifying potentially impacted individuals
Provided access to credit monitoring services for one (1) year, through Kroll
Providing impacted individuals with guidance on how to better protect against identity theft and fraud
Providing written notice of this incident to relevant state regulators, as necessary, and to the three major credit reporting agencies
Changes made: Working to implement additional safeguards and training to its employees
Reviewed our security policies and procedures and are enhancing our security measures to reduce the risk of similar future events
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 32 weeks(226 days from discovery to filing)
Compliance flags: ME AG >30d · 226dME resident >60d · 226d
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Feb 27, 2024
→ Filed with AG: Oct 10, 2024
226d 30 days (soft) ME AG >30d
Maine
Discovered: Feb 27, 2024
→ Notified: Oct 10, 2024
226d 60 days (analyst band; statutory cap is 30 days) ME resident >60d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Feb 27, 2024 → Filed with AG: Oct 10, 2024	226d	30 days (soft)	ME AG >30d
Maine	Discovered: Feb 27, 2024 → Notified: Oct 10, 2024	226d	60 days (analyst band; statutory cap is 30 days)	ME resident >60d

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/6e02f093-3b9b-4aa3-b13d-801236aef546.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 10, 2024
Raw hash: 74bd1e81521b26f816d20bf32c1e9c7b1b840a968f9fe1e14fbc783f60466e0f

Reporting entityAero Simulation, Inc.

Victim entityAero Simulation, Inc.

Incidentdiscovered Feb 27, 2024

Stated responseTook steps to secure the email account

ComplianceME AG >30d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov