Incident Types: The types of cybersecurity incidents that have occurred include Breach, Data Leak and Cyber Attack.

Detection and Response: The company detects and responds to cybersecurity incidents through an third party assistance with consumer credit reporting bureau, and recovery measures with free credit monitoring subscriptions, and communication strategy with direct contact with impacted individuals, communication strategy with advice on signing up for monitoring, and third party assistance with equifax identity monitoring services, and containment measures with password reset, and remediation measures with fraud warnings, identity theft insurance, and communication strategy with breach notification letters, and remediation measures with public denial of new breach, remediation measures with reference to 2022 incident, and communication strategy with media statements, communication strategy with user advisories (via third-party reports), and communication strategy with public disclosure via california ag (january 18, 2023)..

Common Attack Types: The most common types of attacks the company has faced is Breach.

Identification of Attack Vectors: The company identifies the attack vectors used in incidents through Login Credentials, Credential Stuffing, compromised user devices (suspected infostealer infections) and Compromised login credentials.

Commonly Compromised Data Types: The types of data most commonly compromised in incidents are Name, Address, Social Security Number, Individual Tax Identification Number, Date Of Birth, , Personal Information, , Personally Identifiable Information, Transaction Histories, , Contact Information, Personal Transactions, Social Connections, , Names, Addresses, Social Security Numbers, Individual Tax Identification Numbers, Dates Of Birth, , Emails, Plaintext Passwords, Urls, , Personally Identifiable Information (Pii) and .

Third-Party Assistance: The company involves third-party assistance in incident response through Consumer credit reporting bureau, Equifax Identity Monitoring Services.

Prevention of Data Exfiltration: The company takes the following measures to prevent data exfiltration: Fraud Warnings, Identity Theft Insurance, public denial of new breach, reference to 2022 incident, .

Handling of PII Incidents: The company handles incidents involving personally identifiable information (PII) through by password reset.

Data Recovery from Ransomware: The company recovers data encrypted by ransomware through Free credit monitoring subscriptions, .

Key Lessons Learned: The key lessons learned from past incidents are The importance of personal data security for individuals in sensitive government positions.Reused credentials amplify risks across platforms even after initial breaches.,Infostealer malware logs can be repackaged to falsely imply direct corporate breaches.,Low pricing of stolen data may indicate lack of authenticity or prior exploitation.,Proactive user education on password hygiene and MFA remains critical.

Additional Resources: Stakeholders can find additional resources on cybersecurity best practices at and Source: Maine Office of the Attorney GeneralDate Accessed: 2022-12-20, and Source: Cybernews, and Source: California Office of the Attorney GeneralDate Accessed: 2023-01-18.

Communication of Investigation Status: The company communicates the status of incident investigations to stakeholders through Direct Contact With Impacted Individuals, Advice On Signing Up For Monitoring, Breach Notification Letters, Media Statements, User Advisories (Via Third-Party Reports), Public disclosure via California AG (January 18 and 2023).

Advisories Provided: The company provides the following advisories to stakeholders and customers following an incident: were Breach Notification Letters, Change Passwords And Enable Mfa (Via Third-Party Reports)., Avoid Password Reuse Across Platforms. and .

Post-Incident Analysis Process: The company's process for conducting post-incident analysis is described as Consumer credit reporting bureau, Equifax Identity Monitoring Services.

Corrective Actions Taken: The company has taken the following corrective actions based on post-incident analysis: Password Reset, Fraud Warnings, Identity Theft Insurance, Paypal: Clarified No New Breach Occurred (2025 Claim)., Users Advised To Update Security Practices., .

Last Attacking Group: The attacking group in the last incident was an 15-year-old boy.

Most Recent Incident Detected: The most recent incident detected was on 2022-12-20.

Most Recent Incident Publicly Disclosed: The most recent incident publicly disclosed was on 2023-01-18.

Most Significant Data Compromised: The most significant data compromised in an incident were Name, Address, Social Security Number, Individual Tax Identification Number, Date of Birth, , personal information, , User Names, Addresses, Social Security Numbers, Personal Tax Identification Numbers, Dates of Birth, Transaction Histories, , Friend List, Personal Transactions, Social Connections, , names, addresses, Social Security numbers, individual tax identification numbers, dates of birth, , emails, plaintext passwords, associated URLs, , names, addresses, Social Security numbers, dates of birth and .

Third-Party Assistance in Most Recent Incident: The third-party assistance involved in the most recent incident was Consumer credit reporting bureau, Equifax Identity Monitoring Services.

Containment Measures in Most Recent Incident: The containment measures taken in the most recent incident was Password Reset.

Most Sensitive Data Compromised: The most sensitive data compromised in a breach were dates of birth, addresses, Transaction Histories, Address, Dates of Birth, Individual Tax Identification Number, Social Security Numbers, Social Connections, Date of Birth, associated URLs, plaintext passwords, emails, Social Security Number, names, Personal Transactions, Addresses, Social Security numbers, Friend List, Name, personal information, User Names, Personal Tax Identification Numbers and individual tax identification numbers.

Number of Records Exposed in Most Significant Breach: The number of records exposed in the most significant breach was 17.5M.

Highest Fine Imposed: The highest fine imposed for a regulatory violation was unspecified fines related to 2022 incident, .

Most Significant Lesson Learned: The most significant lesson learned from past incidents was Proactive user education on password hygiene and MFA remains critical.

Most Significant Recommendation Implemented: The most significant recommendation implemented to improve cybersecurity was Avoid clicking suspicious links/attachments (infostealer vectors)., Dark web monitoring for leaked corporate credentials., Use security suites with firewall and anti-malware protection., Organizations: Implement credential stuffing protections (e.g., CAPTCHA, rate limiting)., Educate users on recognizing phishing and malware risks., Consider identity theft monitoring services., Enable multi-factor authentication (MFA) on all financial accounts., Users: Change PayPal passwords immediately and avoid reuse across services. and Monitor accounts for unusual activity or identity theft signs..

Most Recent Source: The most recent source of information about an incident are Cybernews, Maine Office of the Attorney General and California Office of the Attorney General.

Current Status of Most Recent Investigation: The current status of the most recent investigation is unverified; PayPal denies new breach, attributes claims to 2022 incident.

Most Recent Customer Advisory: The most recent customer advisory issued were an Breach Notification Letters and Change passwords and enable MFA (via third-party reports).Avoid password reuse across platforms.

Most Recent Entry Point: The most recent entry point used by an initial access broker were an Compromised login credentials, Credential Stuffing and Login Credentials.

Most Significant Root Cause: The most significant root cause identified in post-incident analysis was Weak or Reused Passwords, Likely repackaged infostealer logs from prior compromises (not a direct PayPal breach).User password reuse across platforms.Lack of MFA adoption by some users., Credential reuse / weak authentication.

Most Significant Corrective Action: The most significant corrective action taken based on post-incident analysis was Password Reset, Fraud Warnings, Identity Theft Insurance, PayPal: Clarified no new breach occurred (2025 claim).Users advised to update security practices..