MisuseOtherData MishandlingEmployee Data InvolvedIdentity (basic)Government IDMediumResolved

Sierra Club

bd_2424595bc8ca2c33 · schema v1 · pii pii-v1

Severity

Medium

Discovered

—

Filed

Oct 5, 2023

To disclose

—

Affected

Not disclosed

Linked

6 filings

Confidence

65%

Full breach record for Sierra Club →

Sierra Club notified consumers that a former employee forwarded a file containing names and Social Security numbers of certain employees to their personal email account on or about February 3, 2023. The activity was discovered during a security audit. The employee was terminated. Sierra Club is offering 12 months of complimentary credit monitoring and identity theft protection through Experian.

J jump to incidentP pin to compareR raw source

Incident timeline

Feb 3, 2023

Begins

Oct 5, 2023

Filed

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Maine State AGbd_0817cb1dfc1ba95f2023-10-05Candidate
New Hampshire State AGbd_6210b1910769410b2023-10-05Verified
Massachusetts State AGbd_a5fa06c873e923342023-10-05Verified
Montana State AGbd_dfe987f053485cfe2023-10-05Verified

Show 1 more filing ↓up to 1d gap

Indiana State AGbd_cf1225f15684e8b82023-10-04 · +1dVerified

Name: Sierra Club
norm: sierra club

Name: Sierra Club
norm: sierra club
Industry: Otherllm

Discovered: —
Breach occurred: Feb 3, 2023
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: Identity (basic)Government ID
Data elements: Social Security number
Attack vector: Insider
Threat actor: Internal
Regulator citations: Notifying relevant regulatory authorities
Initial access: insider_action

During the incident: Launched an investigation to determine the scope of information involved
Took steps to mitigate the risk to the impacted file in accordance with internal policies and procedures
Terminated the employment of the individual responsible for this event
Notifying relevant regulatory authorities
Offering access to credit monitoring and identity theft protection services for 12 months through Experian at no cost
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

Indiana State AGOct 4 · first

Maine State AG+1d

New Hampshire State AG+1d

Massachusetts State AG+1d

Montana State AG+1d

Vermont State AG+1d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ago.vermont.gov/document/2023-10-05-sierra-club-data-breach-notice-consumers
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 5, 2023
Raw hash: 9e628e3b051151637e49a666ad5b24bb6c72cc1f017bece6a73b16a941d93922

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entitySierra Club

Victim entitySierra Club

IncidentInsider

Stated responseLaunched an investigation to determine the scope of information involved

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceago.vermont.gov