HackingOtherCustomer Data InvolvedIdentity (basic)Government IDMediumContained

Chapel Hill Presbyterian Church

bd_1dc3b4d369a18c79 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jan 30, 2026

Filed

Mar 23, 2026

To disclose

—

Affected

1state residents only

Linked

4 filings

Confidence

66%

Full breach record for Chapel Hill Presbyterian Church →

Chapel Hill Presbyterian Church, located in Gig Harbor, WA, notified the Nebraska Attorney General of a data security incident affecting one Nebraska resident. The church became aware of unusual network activity on January 30, 2026. Unauthorized access to data occurred on or about February 6, 2026. The affected individual's name and Social Security Number were potentially compromised. Notification was mailed on March 23, 2026. The church engaged cybersecurity experts and offered complimentary identity monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

Feb 6, 2026

Begins

Mar 23, 2026

Filed

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Maine State AGbd_3f7126b595f2003b2026-03-23Candidate
Washington State AGbd_3fcb2437185616f52026-03-23Verified
Massachusetts State AGbd_f655ec2cf9edb7ab2026-03-24 · +1dVerified

Name: Constangy, Brooks, Smith & Prophete, LLP
norm: constangy brooks smith prophete

Name: Chapel Hill Presbyterian Church
norm: chapel hill presbyterian church
Industry: Otherllm

Discovered: Jan 30, 2026
Breach occurred: Feb 6, 2026
Materiality determined: —
Notification sent: Mar 23, 2026
Affected individuals: 1state-resident count only
Data types: Identity (basic)Government ID
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: External
Regulator citations: Submitted notification to Nebraska Attorney General Office
Initial access: exploit_public_facing

During the incident: Engaged cybersecurity experts to assist with the process
Launched an investigation to determine the nature and scope of the event
Conducted a thorough and comprehensive review to determine what information was involved
Notified the identified individuals
Established a toll-free call center
Changes made: Secured the services of Iris Identity Protection to provide complimentary identity monitoring
Took steps to secure our environment
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Maine State AGMar 23 · first

Washington State AGMar 23 · first

Nebraska State AGMar 23 · first · this page

Massachusetts State AG+1d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://nebraska.gov/ago/data-breach/documents/8c426a9c-cb97-4db6-b521-bad28b0d05ed.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 23, 2026
Raw hash: 8a3f471f37e25c0d863c026204bea22c2ae91b9278c64d79389442769da7aaf2

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityConstangy, Brooks, Smith & Prophete, LLP

Victim entityChapel Hill Presbyterian Church

Incidentdiscovered Jan 30, 2026

Stated responseEngaged cybersecurity experts to assist with the process

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancenebraska.gov