UNITE HERE!
bd_17ad976435ab9747 · schema v1 · pii pii-v1
Full breach record for UNITE HERE! →Threat-actor claim — not a regulatory filing
This row is a claim by the ransomware group INC Ransom on its public extortion blog. It has not been validated by the victim or any regulator. Treat attribution and counts as the threat actor's assertion until a regulatory filing or victim disclosure corroborates them.
Source: Ransomware.live
Post text · scraped from the leak site
UNITE HERE is a labor union in the United States and Canada with roughly 300,000 active members. The union's members work predominantly in the hotel, food service, laundry, warehouse, and casino gaming industries. The union was formed in 2004 by the merger of Union of Needletrades, Industrial, and Textile Employees (UNITE) and Hotel Employees and Restaurant Employees Union (HERE). In 2005, UNITE HERE withdrew from the AFLCIO and joined the Change to Win Federation, along with several other unions, including the Teamsters, Service Employees International Union (SEIU) and the UFCW. In May 2009, union president Bruce Raynor (originally from UNITE) left UNITE HERE, taking with him numerous local unions and between 105,000 and 150,000 members, mostly garment workers and a labor-owned bank, Amalgamated Bank. They formed a new SEIU affiliate called Workers United. On September 17, 2009, UNITE HERE announced that it would re-affiliate with the AFLCIO.
J jump to incidentP pin to compareR raw source
Incident timeline — mostly unverified
? — ?
Breach window unknown
Apr 22, 2024
Claim posted
—
Corroborated · see linked filings
Compliance clocks stay unassessable until a regulatory filing lands. Dashed segments fill in automatically when corroboration arrives.
Claim → filing
—
Compliance clock
Not assessable
Linked disclosures
Why this link?Regulatory filings (10) · sorted by filing gap
- Maine State AGbd_2672717fc2d0cde02024-02-23 · +59dVerified by operator
- New Hampshire State AGbd_33e463526bc7668b2024-02-23 · +59dVerified by operator
- Montana State AGbd_35efb62d46022cd62024-02-23 · +59dVerified
- Oregon State AGbd_3729b8bde4d31e492024-02-23 · +59dVerified by operator
Show 6 more filings ↓Show fewer ↑up to 81d gap
- Washington State AGbd_660977128cd7563d2024-02-23 · +59dVerified
- Massachusetts State AGbd_a3d01db5513ffe8e2024-02-23 · +59dVerified by operator
- California State AGbd_ab749990d313fd0c2024-02-23 · +59dVerified by operator
- Indiana State AGbd_c3a0ae0aa0e09f542024-02-23 · +59dVerified by operator
- HHS OCRbd_c61e337919b056d42024-02-23 · +59dVerified by operator
- Illinois State AGbd_5310a1dc1743d6722024-02-01 · +81dVerified
Showing first 10 of 12 linked disclosures.
Filing propagation · 11 filings · 10 states
View merged incident ↗Pattern: first filing Feb 1 (IL), last Apr 22 — a 81-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?
Cascade drawn from the first 10 linked disclosures of 12 — the full spread may be wider.
Evidence ladder
Attacker assertion only. Establishes: claim date, group, alleged victim.
Unlocks: incident narrative, operational impact. Still no compliance clock.
Unlocks: discovery date, data types, affected count, compliance clock.
Unlocks: materiality, stated response, full audit trail. Ceiling removed.
Source ceiling
- actor name
- victim claim
- ransom/leak status
- discovery date
- materiality
- notification
- affected count
- confirmed data types
- compliance clock
The ✕ fields stay blank until a regulatory filing or victim disclosure lands.