HackingRetail & ConsumerRetailCustomer Data InvolvedPIILowContained

Station Casinos LLC

bd_f2aa91ade4b7de0a · schema v1 · pii pii-v1

Severity

Low

Discovered

Mar 5, 2026

Filed

May 21, 2026

To disclose

11 weeks

Affected

1state residents only

Linked

8 filings

Confidence

65%

Full breach record for Station Casinos LLC →

Station Casinos LLC reported an external system breach (hacking) on March 5, 2026, affecting one Maine resident. The breach was discovered on the same date. The company notified the Maine Attorney General and provided written notification to the affected individual on May 21, 2026, along with 12 months of identity theft protection services.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Mar 5, 2026 → Filed with AG May 21, 202677d ⏱ ME AG >30d11 weeks discovery → filing

⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Incident timeline

discovery → filing · 11 weeks / 77 days

Mar 5, 2026

Begins

Mar 5, 2026

Discovered

May 21, 2026

Filed

vs. sector median

+3 wks slower

This filing is one of 8 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (7) · sorted by filing gap

Vermont State AGbd_0e1a2fd3ce7b71f82026-05-21Verified
Nebraska State AGbd_2edacca6205cbd212026-05-21Verified
Indiana State AGbd_69bb9e3dba7b362d2026-05-21Candidate
New Hampshire State AGbd_aca6948252489f912026-05-26 · +5dVerified

Show 3 more filings ↓up to 76d gap

Massachusetts State AGbd_19e7ac2e50bce1102026-05-27 · +6dVerified
Nebraska State AGbd_0cdfdb4b642a88d22026-08-05 · +76dVerified
California State AGbd_828a5dd42e1a076b2026-08-05 · +76dVerified

Name: Station Casinos LLC
norm: station casinos

Name: Station Casinos LLC
norm: station casinos
Industry: Retail & Consumerllm

Discovered: Mar 5, 2026
Breach occurred: Mar 5, 2026
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: May 21, 2026
Affected individuals: 1state-resident count only
Data types: PII
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: External
Regulator citations: Filed data breach notice with Maine Attorney General
Initial access: exploit_public_facing

During the incident: Sent written notification to affected residents
Offered 12 months of identity theft protection services
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 11 weeks(77 days from discovery to filing)
Compliance flags: ME AG >30d · 77d
Discovery-date grounding: occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Mar 5, 2026
→ Filed with AG: May 21, 2026
77d 30 days (soft) ME AG >30d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Mar 5, 2026 → Filed with AG: May 21, 2026	77d	30 days (soft)	ME AG >30d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 8 filings · 7 states

View merged incident ↗

Vermont State AGMay 21 · first

Nebraska State AGMay 21 · first

Indiana State AGMay 21 · first

Maine State AGMay 21 · first · this page

New Hampshire State AG+5d

Massachusetts State AG+6d

Nebraska State AG+76d

California State AG+76d

Pattern: first filing May 21 (VT), last Aug 5 (CA) — a 76-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/b2fed8e3-69c7-432b-a6f7-33f715579484.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 21, 2026
Raw hash: 41a31833a4a87f444215f953c05e7236096fbf630f940318f63c04e491c80e42

Linked disclosures

Regulatory filings (7) · sorted by filing gap

Reporting entityStation Casinos LLC

Victim entityStation Casinos LLC

Incidentdiscovered Mar 5, 2026

Stated responseSent written notification to affected residents

ComplianceME AG >30d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov