HackingStolen CredentialsSupply Chain (3P Vendor)Data ExfiltratedIDENTITY_BASICIDENTITY_GOVERNMENTFINANCIAL_ACCOUNTMediumContained
Selman & Company, LLC
bd_2c2c690fda470981 · schema v1 · pii pii-v1
Full breach record for Selman & Company, LLC →Selman & Company, LLC notified Vermont AG of a data breach involving its third-party hosting provider, PAS-SG/PAS Hosting. On August 15, 2024, an unauthorized third party accessed files containing plan participants' personal information, including names, SSNs, and financial account numbers. Selman is offering 24 months of Equifax credit monitoring. The incident is contained; no misuse is currently known.
Vermont clock✗ VT AG >45 bday12 weeks discovery → filing
⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
This filing is one of 3 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (2) · sorted by filing gap
- bd_aa6a4120cba3f41fIndiana State AGfiled 2024-11-04Verified
- bd_ed42efba91d8a198Maine State AGfiled 2024-11-04Candidate
Source provenance
- Source URL
- https://ago.vermont.gov/document/2024-11-04-selman-company-data-breach-notice-consumers
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Nov 4, 2024
- Raw hash
- cb5f3b26b2012499ce09b56df1ca6208bd66d1e41f526e9cde7e4af145ed4fe1
Reporting entity
- Name
- Selman & Company, LLCnorm: selman
Victim entity
- Name
- Selman & Company, LLCnorm: selman
Incident
- Discovered
- Aug 15, 2024
- Materiality determined
- —
- Notification sent
- Nov 4, 2024
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENTFINANCIAL_ACCOUNT
- Attack vector
- Third-Party / Supply Chain
- MITRE ATT&CK
- T1195 Supply Chain CompromiseT1078 Valid Accounts
- Threat actor
- External
- Regulator citations
- Filed notice with Vermont Attorney General
- Third party
- via PAS-SG/PAS Hosting
- Initial access
- supply_chain
Compliance
- Time to disclose
- 12 weeks(81 days from discovery to filing)
- Compliance flags
- VT AG >45 bday
- Discovery-date grounding
- occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.