HackingRetail & ConsumerRetailStolen CredentialsCustomer Data InvolvedGovernment IDIdentity (basic)HighContained

New TSI Holdings, Inc.

bd_10ec0063cca1a63d · schema v1 · pii pii-v1

Severity

High

Discovered

Aug 23, 2024

Filed

Sep 26, 2024

To disclose

5 weeks

Affected

19,836scope not determined

Confidence

66%

Full breach record for New TSI Holdings, Inc. →

New TSI Holdings, Inc. (New York Sports Club) disclosed a data breach occurring on or about July 27, 2024, discovered on August 23, 2024. An unauthorized user accessed files on servers containing employee names, Social Security numbers, and passport numbers affecting approximately 19,836 individuals. The company changed passwords, enhanced security, and is implementing MFA. IDX identity protection services are offered to affected individuals.

J jump to incidentP pin to compareR raw source

Vermont clock⏱ VT AG >14 bday5 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 27 days

discovery → filing · 5 weeks / 34 days

Jul 27, 2024

Begins

Aug 23, 2024

Discovered

Sep 26, 2024

Filed

vs. sector median

3 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed19,836 affectedView incident

Name: New TSI Holdings, Inc.
norm: new tsi

Name: New TSI Holdings, Inc.
norm: new tsi
Industry: Retail & Consumerllm

Discovered: Aug 23, 2024
Breach occurred: Jul 27, 2024
Undetected for: 27 daysoccurrence → discovery
Materiality determined: —
Notification sent: Sep 26, 2024
Affected individuals: 19,836scope not determined
Data types: Government IDIdentity (basic)
Data elements: Social Security number
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Initial access: valid_credentials

During the incident: Changed all passwords for servers and email accounts
Enhanced network security features
Implementing multi-factor authentication on systems
Actively monitoring servers and email accounts
Offering identity theft protection services through IDX
Changes made: Implementing multi-factor authentication on systems
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 weeks(34 days from discovery to filing)
Compliance flags: VT AG >14 bday
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ago.vermont.gov/document/2024-09-26-new-tsi-holdings-new-york-sports-club-data-breach-notice-consumers
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 26, 2024
Raw hash: 00171b77d6cb53b24ffee5d776467f541a8ce8efd94572f2c09d9d324145db50

Reporting entityNew TSI Holdings, Inc.

Victim entityNew TSI Holdings, Inc.

Incidentdiscovered Aug 23, 2024

Stated responseChanged all passwords for servers and email accounts

ComplianceVT AG >14 bday

Extraction provenanceno artifact recorded

Source provenanceago.vermont.gov