MalwareProfessional ServicesProfessional ServicesRansomwareRansom DemandedData EncryptedIdentity (basic)Government IDLow

Morning Star Tours

bd_0e641fbac615e0f1 · schema v1 · pii pii-v2

Severity

Low

Discovered

Apr 22, 2026

Filed

May 31, 2026

To disclose

6 weeks

Affected

500state residents only

Linked

7 filings

Confidence

95%

Morning Star Tours, a business sector entity reported a ransomware incident to the Washington Attorney General. The organization became aware of the incident on 2026-04-22 and filed notice on 2026-05-31. 500 Washington residents were affected. 39 days elapsed between awareness and notification. 0 days to identify the breach. 8 days to contain the breach.

J jump to incidentP pin to compareR raw source

Washington clock⏱ WA AG >30d6 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

discovery → filing · 6 weeks / 39 days

Apr 22, 2026

Discovered

May 31, 2026

Filed

vs. sector median

13 wks faster

This filing is one of 7 about the same incident.View merged incident

A leak claim by pear about this victim predates this filing by 31 days.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Sitepearbd_0c1e4715642d603f2026-04-30 · +31dVerified by operator

Regulatory filings (5) · sorted by filing gap

Oregon State AGbd_20876571713543942026-05-31Verified
California State AGbd_7301f95c246ef5492026-05-31Verified
New Hampshire State AGbd_2b352c628dc9653f2026-06-01 · +1dVerified
Texas State AGbd_8f1c93ac9f2daf5c2026-06-01 · +1dVerified

Show 1 more filing ↓up to 1d gap

Vermont State AGbd_ab0ebf3c34dffdc62026-06-01 · +1dVerified

Name: Morning Star Tours
norm: morning star tours
Domain: morningstartravel.org

Name: Morning Star Tours
norm: morning star tours
Domain: morningstartravel.org
Industry: Professional Servicesllm

Discovered: Apr 22, 2026
Materiality determined: —
Notification sent: —
Affected individuals: 500state-resident count only
Data types: Identity (basic)Government ID
WA-stated cause: Cyberattack
WA-stated duration: lifecycle 1-99dexposure 1-99d
WA-stated discovery: Found while ongoing
Attack vector: Ransomware
Threat actor: ExternalFinancial

Time to disclose: 6 weeks(39 days from discovery to filing)
Compliance flags: WA AG >30dLeak >30d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

Oregon State AGMay 31 · first

California State AGMay 31 · first

Washington State AGMay 31 · first · this page

New Hampshire State AG+1d

Texas State AG+1d

Vermont State AG+1d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://data.wa.gov/resource/sb4j-ca4h.json?id=24230
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 31, 2026
Raw hash: 37dbe25ef24632e7d09202758bd2718899faef62ce22213af04fb26fd753fd6c

Linked disclosures

Ransomware claims (1)

Regulatory filings (5) · sorted by filing gap

Reporting entityMorning Star Tours

Victim entityMorning Star Tours

Incidentdiscovered Apr 22, 2026

ComplianceWA AG >30d

Extraction provenanceno artifact recorded

Source provenancedata.wa.gov