Social EngineeringPhishingCustomer Data InvolvedIDENTITY_BASICIDENTITY_GOVERNMENTMediumContained
Progress Foundation
bd_34e6e9ca20d00b8d · schema v1 · pii pii-v1
Full breach record for Progress Foundation →Progress Foundation disclosed that employee W-2s containing names and Social Security numbers were inadvertently disclosed to an unauthorized actor on February 2, 2026. The incident was discovered on the same date. Progress Foundation investigated, confirmed system security, notified law enforcement and the IRS, and offered credit monitoring via Epiq to affected individuals.
Vermont clock✓ VT AG ≤14 bday10 days discovery → filing
⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
This filing is one of 2 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (1) · sorted by filing gap
- bd_a5a16a5dfb9a51caCalifornia State AGfiled 2026-02-02(10d gap)Candidate
Source provenance
- Source URL
- https://ago.vermont.gov/document/2026-02-12-progress-foundation-data-breach-notice-consumers
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Feb 12, 2026
- Raw hash
- b685380d3d06db1378b62866c39240dc31f54b599bf4e870cd78f30da5015300
Reporting entity
- Name
- Progress Foundationnorm: progress foundation
Victim entity
- Name
- Progress Foundationnorm: progress foundation
Incident
- Discovered
- Feb 2, 2026
- Materiality determined
- —
- Notification sent
- Feb 12, 2026
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENT
- Attack vector
- Third-Party / Supply Chain
- MITRE ATT&CK
- T1566.002 Spearphishing LinkT1078 Valid Accounts
- Threat actor
- External
- Regulator citations
- notified federal law enforcement and the Internal Revenue Service
- Initial access
- phishing_link
Compliance
- Time to disclose
- 10 days(10 days from discovery to filing)
- Compliance flags
- VT AG ≤14 bday
- Discovery-date grounding
- occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.