HackingStolen CredentialsData ExfiltratedCustomer Data InvolvedIDENTITY_GOVERNMENTIDENTITY_BASICHighContained
McMenamins, Inc.
bd_feba65f7cb20750a · schema v1 · pii pii-v1
Full breach record for McMenamins, Inc. →McMenamins, Inc. reported an external system breach (hacking) occurring on December 7, 2021, discovered on December 12, 2021. The incident compromised names and Social Security Numbers of 20,504 individuals, including 10 Maine residents. The company provided written notification and offered 12 months of credit monitoring through Experian IdentityWorks.
Maine clockDiscovered Dec 12, 2021 → Filed with AG Jan 18, 202237d ⏱ ME AG >30d5 weeks discovery → filing
⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.
This filing is one of 3 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (2) · sorted by filing gap
- bd_48a7a67a3ff6841cWashington State AGfiled 2021-12-30(19d gap)Candidate
- bd_7f15c8a5259550ddOregon State AGfiled 2021-12-30(19d gap)Verified
Source provenance
- Source URL
- https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/00eb8be9-5d5d-4cb9-acc7-1625f3de9380.shtml
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Jan 18, 2022
- Raw hash
- 825d446d7d78829a455dc0b50c68dc03abfcb596549482b407fd90ec61ddc32a
Reporting entity
- Name
- McMenamins, Inc.norm: mcmenamins
Victim entity
- Name
- McMenamins, Inc.norm: mcmenamins
Incident
- Discovered
- Dec 12, 2021
- Materiality determined
- —
- Notification sent
- Dec 30, 2021
- Affected individuals
- 20,504
- Data types
- IDENTITY_GOVERNMENTIDENTITY_BASIC
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1190 Exploit Public-Facing Application
- Threat actor
- ExternalFinancial
- Regulator citations
- Filed data breach notice with Maine Attorney General
- Initial access
- valid_credentials
Compliance
- Time to disclose
- 5 weeks(37 days from discovery to filing)
- Compliance flags
- ME AG >30d · 37d
- Discovery-date grounding
- AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.
- Clock breakdown
Statute Window Elapsed Threshold Status Maine Discovered: Dec 12, 2021→ Filed with AG: Jan 18, 202237d 30 days (soft) ME AG >30d
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.