HackingStolen CredentialsCustomer Data InvolvedPIIIDENTITY_BASICLowContained

OneGroup

bd_007e931fdace5753 · schema v1 · pii pii-v1

OneGroup NY Inc. notified consumers of an unauthorized access to an employee's email account between May 6 and May 21, 2024. The incident involved personal information associated with MEMIC Indemnity workers' compensation policies. OneGroup offered 24 months of credit monitoring via TransUnion. No specific count of affected individuals was disclosed in this notice.

Vermont clock✗ VT AG >45 bday45 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Source provenance

Source URL: https://ago.vermont.gov/document/2025-06-06-onegroup-ny-data-breach-notice-consumers
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 6, 2025
Raw hash: d9e83e2cff3ea0d7aecc5b92144aaaa1df09304f668707ee21876a80fa898327

Reporting entity

Name: OneGroup
norm: onegroup
Domain: onegroup.com

Victim entity

Name: OneGroup
norm: onegroup
Domain: onegroup.com

Incident

Discovered: Jul 29, 2024
Materiality determined: —
Notification sent: Jun 6, 2025
Affected individuals: Not disclosed
Data types: PIIIDENTITY_BASIC
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Initial access: valid_credentials

Compliance

Time to disclose: 45 weeks(312 days from discovery to filing)
Compliance flags: VT AG >45 bday
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Extraction provenance

Status: No extraction artifact recorded for this disclosure.