HackingProfessional ServicesProfessional ServicesVulnerability ExploitSupply Chain (3P Vendor)Data ExfiltratedIdentity (basic)Government IDMediumContained

City Facilities Management (US) LLC

bd_30e3ff28eaf35b92 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Nov 30, 2023

Filed

Dec 28, 2023

To disclose

28 days

Affected

Not disclosed

Linked

5 filings

Confidence

67%

Full breach record for City Facilities Management (US) LLC →

City Facilities Management (US) LLC notified Vermont AG that a third-party vendor, Paycor, was impacted by the MOVEit Transfer vulnerability (Progress Software). The incident exposed affected individuals' addresses and Social Security numbers. City coordinated with Paycor, implemented recommended actions, and provided 24 months of credit monitoring. No specific count of affected individuals was disclosed in the filing.

J jump to incidentP pin to compareR raw source

Vermont clock⏱ VT AG >14 bday28 days discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

discovery → filing · 28 days

Nov 30, 2023

Discovered

Dec 28, 2023

Filed

vs. sector median

14 wks faster

This filing is one of 5 about the same incident.View merged incident

Part of Paycor supply-chain incident (2023) — a supply-chain cascade affecting multiple organizations.View cascade →

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Indiana State AGbd_4aa925fc235317322023-12-28Verified
Massachusetts State AGbd_8ef1c32c794afb322023-12-28Verified
Maine State AGbd_e9332d3a0ac434972023-12-28Candidate
New Hampshire State AGbd_bf62ca5ea2e7892c2023-12-29 · +1dVerified

Name: City Facilities Management (US) LLC
norm: city facilities management us

Name: City Facilities Management (US) LLC
norm: city facilities management us
Industry: Professional Servicesllm

Discovered: Nov 30, 2023
Materiality determined: —
Notification sent: Dec 28, 2023
Affected individuals: Not disclosed
Data types: Identity (basic)Government ID
Data elements: Social Security numberDate of birth
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain CompromiseT1190 Exploit Public-Facing Application
Threat actor: ExternalFinancial
Initial access: exploit_public_facing

During the incident: Coordinating with Paycor
Implementing Paycor's recommended actions
Monitoring publicly available information regarding this vulnerability
Enhancing security controls
Arranging for 24 months of credit monitoring services from Experian
Changes made: Enhancing security controls to help protect against cyber threats
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 28 days(28 days from discovery to filing)
Compliance flags: VT AG >14 bday
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Indiana State AGDec 28 · first

Massachusetts State AGDec 28 · first

Maine State AGDec 28 · first

Vermont State AGDec 28 · first · this page

New Hampshire State AG+1d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ago.vermont.gov/document/2023-12-28-city-facilities-management-progress-software-moveit-data-breach-notice-consumers
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 28, 2023
Raw hash: 4b8946f5c5deb43f59461aff445cba9b1117d4edc452261a8e5a3bb045931482

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityCity Facilities Management (US) LLC

Victim entityCity Facilities Management (US) LLC

Incidentdiscovered Nov 30, 2023

Stated responseCoordinating with Paycor

ComplianceVT AG >14 bday

Extraction provenanceno artifact recorded

Source provenanceago.vermont.gov