HackingOtherDelayed DiscoveryIdentity (basic)LowContained

Water For People

bd_1f8df32e54c704c8 · schema v1 · pii pii-v1

Severity

Low

Discovered

Dec 15, 2023

Filed

Sep 5, 2024

To disclose

38 weeks

Affected

Not disclosed

Linked

8 records

Confidence

66%

Full breach record for Water For People →

Water For People notified consumers of unauthorized access to its computer systems discovered on December 15, 2023. The incident may have exposed names combined with other personal data. The organization engaged forensic investigators, secured its network, and offered complimentary credit monitoring via Equifax. No evidence of misuse was found.

J jump to incidentP pin to compareR raw source

Vermont clock✗ VT AG >45 bday38 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

discovery → filing · 38 weeks / 265 days

Dec 15, 2023

Discovered

Sep 5, 2024

Filed

vs. sector median

+32 wks slower

This filing is one of 8 records about the same incident.View merged incident

A leak claim by medusa about this victim was first seen 238 days before this filing.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Sitemedusabd_b8955f0cd698c83e2023-12-15 · +265dVerified by operator

Regulatory filings (5) · sorted by filing gap

Montana State AGbd_2f77e69a7542f2f82024-09-05Candidate
New Hampshire State AGbd_328e5b2385a6a76d2024-09-05Verified
Indiana State AGbd_8937325be81321412024-09-05Verified
Washington State AGbd_fcdf66f98c82eef32024-09-05Verified

Show 1 more filing ↓up to 1d gap

Massachusetts State AGbd_d16592a54ea711c12024-09-06 · +1dVerified by operator

Press reports (1)

Pressmedusabd_f6127a1f201b04702023-12-15 · +265dCandidate

Name: Water For People
norm: water for people
Domain: waterforpeople.org

Name: Water For People
norm: water for people
Domain: waterforpeople.org
Industry: Otherllm

Discovered: Dec 15, 2023
Materiality determined: —
Notification sent: Sep 5, 2024
Affected individuals: Not disclosed
Data types: Identity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Initial access: valid_credentials

During the incident: Secured our network
Engaged a third-party team of forensic investigators
Secured our systems
Enhanced the security of our network
Arranged for you to enroll, at no cost to you, in an online credit monitoring service for 12/24 months through Equifax
Changes made: Enhanced the security of our network to prevent similar incidents from occurring in the future
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 38 weeks(265 days from discovery to filing)
Compliance flags: VT AG >45 bdayLeak >180d
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

Montana State AGSep 5 · first

New Hampshire State AGSep 5 · first

Indiana State AGSep 5 · first

Washington State AGSep 5 · first

Vermont State AGSep 5 · first · this page

Massachusetts State AG+1d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ago.vermont.gov/document/2024-09-05-water-people-data-breach-notice-consumers
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 5, 2024
Raw hash: 440691059492a57d3f2a6e4b9b688a56490df6db94713e4969e7e2c6092ddca3

Linked disclosures

Ransomware claims (1)

Regulatory filings (5) · sorted by filing gap

Press reports (1)

Reporting entityWater For People

Victim entityWater For People

Incidentdiscovered Dec 15, 2023

Stated responseSecured our network

ComplianceVT AG >45 bday

Extraction provenanceno artifact recorded

Source provenanceago.vermont.gov