HackingStolen CredentialsCustomer Data InvolvedIDENTITY_GOVERNMENTIDENTITY_BASICHighContained
New TSI Holdings, Inc.
bd_10ec0063cca1a63d · schema v1 · pii pii-v1
Full breach record for New TSI Holdings, Inc. →New TSI Holdings, Inc. (New York Sports Club) disclosed a data breach occurring on or about July 27, 2024, discovered on August 23, 2024. An unauthorized user accessed files on servers containing employee names, Social Security numbers, and passport numbers affecting approximately 19,836 individuals. The company changed passwords, enhanced security, and is implementing MFA. IDX identity protection services are offered to affected individuals.
Vermont clock⏱ VT AG >14 bday5 weeks discovery → filing
⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed19,836 affectedView incident
Source provenance
- Source URL
- https://ago.vermont.gov/document/2024-09-26-new-tsi-holdings-new-york-sports-club-data-breach-notice-consumers
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Sep 26, 2024
- Raw hash
- 00171b77d6cb53b24ffee5d776467f541a8ce8efd94572f2c09d9d324145db50
Reporting entity
- Name
- New TSI Holdings, Inc.norm: new tsi
Victim entity
- Name
- New TSI Holdings, Inc.norm: new tsi
Incident
- Discovered
- Aug 23, 2024
- Materiality determined
- —
- Notification sent
- Sep 26, 2024
- Affected individuals
- 19,836
- Data types
- IDENTITY_GOVERNMENTIDENTITY_BASIC
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1078 Valid Accounts
- Threat actor
- External
- Initial access
- valid_credentials
Compliance
- Time to disclose
- 5 weeks(34 days from discovery to filing)
- Compliance flags
- VT AG >14 bday
- Discovery-date grounding
- unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.