HackingCustomer Data InvolvedTargetedIDENTITY_BASICIDENTITY_GOVERNMENTMediumContained
Visit Charlottesville
bd_2094a60fb31ec6d4 · schema v1 · pii pii-v1
Full breach record for Visit Charlottesville →Charlottesville Settlement Company (CSC) notified the New Hampshire Attorney General of a data security incident affecting 22 NH residents. An unknown actor gained unauthorized access to CSC's network on September 2, 2025. CSC discovered unusual activity on September 4, 2025, and confirmed on March 10, 2026, that personal information (names, SSNs, driver's license numbers) may have been accessed. CSC engaged forensic experts, hardened its environment, and provided 12 months of credit monitoring and identity protection services to affected individuals.
This filing is one of 3 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (2) · sorted by filing gap
- bd_cbcb08c4beceeda9Vermont State AGfiled 2026-03-18Verified
- bd_f42fbb8dbbc0de96Indiana State AGfiled 2026-03-18Candidate
Source provenance
- Source URL
- https://mm.nh.gov/files/uploads/doj/remote-docs/charlottesville-settlement-company-20260318.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Mar 18, 2026
- Raw hash
- 86ccfcc73c3fb68247c649def176f82267d71bb1972f5a7e488b7260901a5409
Reporting entity
- Name
- Visit Charlottesvillenorm: visit charlottesville
- Domain
- visitcharlottesville.org
Victim entity
- Name
- Visit Charlottesvillenorm: visit charlottesville
- Domain
- visitcharlottesville.org
Incident
- Discovered
- Sep 4, 2025
- Materiality determined
- —
- Notification sent
- Mar 18, 2026
- Affected individuals
- 22
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENT
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1078 Valid Accounts
- Threat actor
- External
- Regulator citations
- Notified New Hampshire Attorney General
- Initial access
- valid_credentials
Compliance
- Time to disclose
- 28 weeks(195 days from discovery to filing)
- Compliance flags
- — (clock not assessable for this source)
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.