HackingProfessional ServicesProfessional ServicesSupply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDHighContained

Americhek

bd_fd09eb75d56ac926 · schema v1 · pii pii-v1

Severity

High

Discovered

Oct 29, 2024

Filed

Dec 13, 2024

To disclose

22 days

Affected · nationwide

7,6647 in this filing

Linked

6 filings

Confidence

65%

Full breach record for Americhek →

Certified Employment Screening Inc. dba Americhek reported a third-party vendor breach involving BackChecked LLC. An unauthorized individual accessed BackChecked's systems on September 26, 2024, potentially obtaining applicant PII including names, DOBs, driver's license numbers, and SSNs. Americhek discovered the incident on November 21, 2024, and notified 7,664 individuals (including 7 Maine residents) on December 13, 2024. Remediation included offering 12 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Oct 29, 2024 → Filed with AG Dec 13, 202445d ⏱ ME AG >30d22 days discovery → filing

Incident timeline

undetected · 33 days

discovery → filing · 6 weeks / 45 days

Sep 26, 2024

Begins

Oct 29, 2024

Discovered

Dec 13, 2024

Filed

vs. sector median

16 wks faster

This filing is one of 6 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Vermont State AGbd_339bfb31c634d2932024-12-13Verified by operator
California State AGbd_35058142b0ccc5992024-12-13Verified by operator
Montana State AGbd_7d55b9a65aa9ac1d2024-12-13Candidate
New Hampshire State AGbd_c9273a019b67f0da2024-12-13Verified by operator

Show 1 more filing ↓

Massachusetts State AGbd_e745bf85d03ba1962024-12-13Verified by operator

Name: Constangy, Brooks, Smith & Prophete, LLP
norm: constangy brooks smith prophete

Name: Americhek
norm: americhek
Also named: Certified Employment Screening Inc.dba oflegal entity
Americhekdba oftrade name
Industry: Professional Servicesllm

Discovered: Oct 29, 2024
Breach occurred: Sep 26, 2024
Undetected for: 33 daysoccurrence → discovery
Materiality determined: —
Notification sent: Dec 13, 2024
Affected individuals: 7,664state + nationwide
Data types: Identity (basic)Government ID
Data elements: Social Security numberDate of birth
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1119 Automated Collection
Threat actor: External
Regulator citations: Notified Maine Attorney General Aaron Frey
Initial access: exploit_public_facing

During the incident: BackChecked took steps to investigate and terminate any further unauthorized access to its systems
Americhek began assessing the scope of the potentially impacted data
Americhek conducted a thorough review of the types of personal information impacted
Americhek identified potentially affected individuals and verified current mailing addresses
Americhek notified affected Maine residents via first class U.S. mail
Americhek is offering complimentary credit and identity protection services to all notified individuals
Changes made: Offering complimentary credit and identity protection services through IDX for 12 months
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 22 days(22 days from discovery to filing)
Compliance flags: ME AG >30d · 45d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Oct 29, 2024
→ Filed with AG: Dec 13, 2024
45d 30 days (soft) ME AG >30d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Oct 29, 2024 → Filed with AG: Dec 13, 2024	45d	30 days (soft)	ME AG >30d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

Vermont State AGDec 13 · first

California State AGDec 13 · first

Montana State AGDec 13 · first

New Hampshire State AGDec 13 · first

Massachusetts State AGDec 13 · first

Maine State AGDec 13 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/b702a9c7-4562-49aa-89d2-64e4bcc7226d.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 13, 2024
Raw hash: c1734748c2b4ff1efbe524f9a2d5009e855fc1a3c86ad2f4bab0bacef8bc650b

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityConstangy, Brooks, Smith & Prophete, LLP

Victim entityAmerichek

Incidentdiscovered Oct 29, 2024

Stated responseBackChecked took steps to investigate and terminate any further unauthorized access to its systems

ComplianceME AG >30d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov