HackingEducationEducationStolen CredentialsCustomer Data InvolvedIdentity (basic)Government IDFinancial accountMediumActive

The Young Men's and Young Women's Hebrew Association

bd_285d8738060c2799 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Aug 23, 2021

Filed

Oct 1, 2021

To disclose

6 weeks

Affected

3state residents only

Linked

4 filings

Confidence

65%

Full breach record for The Young Men's and Young Women's Hebrew Association →2 incidents on file

The Young Men's and Young Women's Hebrew Association (92Y) notified individuals of unauthorized network access identified in August 2021. Data potentially involved included names, SSNs, government IDs, and financial account numbers. The organization offered credit monitoring and enhanced security measures. Investigation was ongoing at the time of notification.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 22 days

discovery → filing · 6 weeks / 39 days

Aug 1, 2021

Begins

Aug 23, 2021

Discovered

Oct 1, 2021

Filed

This filing is one of 4 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Massachusetts State AGbd_15b393db96ac991c2021-10-01Verified
Maine State AGbd_5d13a06a419cad2d2021-10-01Verified
Indiana State AGbd_e23e92bcb293dc4b2021-10-01Verified

Name: The Young Men's and Young Women's Hebrew Association
norm: the young men s and young women s hebrew

Name: The Young Men's and Young Women's Hebrew Association
norm: the young men s and young women s hebrew
Industry: Educationllm

Discovered: Aug 23, 2021
Breach occurred: Aug 1, 2021 – Aug 31, 2021
Undetected for: 22 daysoccurrence → discovery
Materiality determined: —
Notification sent: Oct 1, 2021
Affected individuals: 3state-resident count only
Data types: Identity (basic)Government IDFinancial account
Data elements: Social Security number
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: ExternalFinancial
Initial access: valid_credentials

During the incident: Implemented additional technical security measures
Reviewing and enhancing existing policies and procedures
Offering you complimentary access to credit monitoring through IDX
Changes made: Reviewing and enhancing existing policies and procedures
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 weeks(39 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Massachusetts State AGOct 1 · first

Maine State AGOct 1 · first

Indiana State AGOct 1 · first

Montana State AGOct 1 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/consumer-notification-letter-20.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 1, 2021
Raw hash: 9194bffddefa7bcd030d3d27d45b5c04017707978aa7d3fb19668668def2e090

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityThe Young Men's and Young Women's Hebrew Association

Victim entityThe Young Men's and Young Women's Hebrew Association

Incidentdiscovered Aug 23, 2021

Stated responseImplemented additional technical security measures

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov