HackingVulnerability ExploitZero-DayData ExfiltratedIDENTITY_BASICLowActive
CWT Travel Holdings, Inc
bd_2ea1573b2a2439f7 · schema v1 · pii pii-v1
Full breach record for CWT Travel Holdings, Inc →CWT Travel Holdings, Inc. notified consumers of a data breach involving the MOVEit Transfer tool. An unknown actor exploited zero-day vulnerabilities to access the server between May 28-29, 2023, and exfiltrated personal information. CWT engaged third-party specialists, notified regulators and law enforcement, and offered 24 months of credit monitoring. The Vermont AG notice specifically covers 4 Rhode Island residents.
Vermont clock⏱ VT AG >14 bday7 weeks discovery → filing
⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
This filing is one of 3 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (2) · sorted by filing gap
- bd_0501bae7cf700d25Montana State AGfiled 2023-09-22Candidate
- bd_66053990c0ae5fc7Maine State AGfiled 2023-09-22Candidate
Source provenance
- Source URL
- https://ago.vermont.gov/document/2023-09-22-cwt-travel-progress-software-moveit-data-breach-notice-consumers
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Sep 22, 2023
- Raw hash
- 78fa59b66f643d459e344ae782dd4000489fecb2aaf6e997e2f6560de684d13a
Reporting entity
- Name
- CWT Travel Holdings, Incnorm: cwt travel
Victim entity
- Name
- CWT Travel Holdings, Incnorm: cwt travel
Incident
- Discovered
- Aug 2, 2023
- Materiality determined
- —
- Notification sent
- Sep 22, 2023
- Affected individuals
- 4
- Data types
- IDENTITY_BASIC
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 Channel
- Threat actor
- ExternalFinancial
- Regulator citations
- Notified state and industry regulators as required
- Initial access
- exploit_public_facing
Compliance
- Time to disclose
- 7 weeks(51 days from discovery to filing)
- Compliance flags
- VT AG >14 bday
- Discovery-date grounding
- unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.