CCARC, Inc.

The Maine Office of the Attorney General disclosed that CCARC, Inc. suffered a data breach where unauthorized actors gained access to sensitive personal information of 2,450 individuals, including driver’s license numbers and Social Security numbers. The breach occurred over a three-day window (September 11–14, 2022) but was only detected on October 25, 2022, indicating a delayed discovery. The exposed data poses a high risk of identity theft and financial fraud, prompting the company to offer 24 months of identity theft protection services via Cyberscout to affected individuals. The incident highlights vulnerabilities in CCARC’s data security measures, particularly in safeguarding highly sensitive personally identifiable information (PII). While no immediate financial losses or systemic disruptions were reported, the breach’s nature—targeting government-issued identifiers—elevates concerns over long-term reputational damage and potential regulatory scrutiny. The delayed detection further exacerbates risks, as attackers may have had prolonged access to exploit the stolen data.

Source: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/daec2a06-bb06-4f97-b615-57b61b681c6d.shtml

TPRM report: https://www.rankiteo.com/company/ccarc-inc

"id": "cca040090625",
"linkid": "ccarc-inc",
"type": "Breach",
"date": "9/2022",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"

{'affected_entities': [{'customers_affected': 2450,
                        'location': 'Maine, USA',
                        'name': 'CCARC, Inc.',
                        'type': 'Organization'}],
 'customer_advisories': ['Identity theft protection services (Cyberscout) '
                         'offered for 24 months'],
 'data_breach': {'data_exfiltration': 'Yes',
                 'number_of_records_exposed': 2450,
                 'personally_identifiable_information': ["Driver's license "
                                                         'numbers',
                                                         'Social Security '
                                                         'numbers'],
                 'sensitivity_of_data': 'High',
                 'type_of_data_compromised': ['Personally Identifiable '
                                              'Information (PII)']},
 'date_detected': '2022-10-25',
 'description': 'The Maine Office of the Attorney General reported that CCARC, '
                'Inc. experienced a data breach involving unauthorized access '
                'to the personal information of 2,450 individuals, including '
                "driver's license numbers and Social Security numbers. The "
                'breach occurred between September 11, 2022, and September 14, '
                '2022, and was discovered on October 25, 2022. Identity theft '
                'protection services from Cyberscout were offered for 24 '
                'months to those affected.',
 'impact': {'data_compromised': ["Driver's license numbers",
                                 'Social Security numbers'],
            'identity_theft_risk': 'High (PII exposed)'},
 'references': [{'source': 'Maine Office of the Attorney General'}],
 'regulatory_compliance': {'regulatory_notifications': ['Maine Office of the '
                                                        'Attorney General']},
 'response': {'third_party_assistance': ['Cyberscout (Identity theft '
                                         'protection services)']},
 'title': 'Data Breach at CCARC, Inc.',
 'type': 'Data Breach'}