UnknownRetail & ConsumerRetailCustomer Data InvolvedDelayed DiscoveryFinancial accountHealth (basic)Identity (basic)Government IDPCIMediumContained

Brett-Robinson

bd_3537d08f65766503 · schema v1 · pii pii-v1

Severity

Medium

Discovered

—

Filed

Jan 8, 2026

To disclose

—

Affected

2state residents only

Linked

5 filings

Confidence

66%

Full breach record for Brett-Robinson →4 incidents on file

Brett Robinson Vacation Rentals notified individuals of a data security incident where unauthorized access occurred between March 26, 2025, and April 21, 2025. The company discovered the potential exposure of personal data on December 29, 2025, following a forensic investigation. Affected data includes full names, Social Security Numbers, and for some individuals, Account and Routing Numbers. The company engaged external cybersecurity professionals and is offering credit monitoring and fraud assistance services.

J jump to incidentP pin to compareR raw source

Leak gap clock✗ Leak >180d

⚠ no discovery dateNo discovery date was extracted, so no notification clock can be evaluated.

Incident timeline

Mar 26, 2025

Begins

Jan 8, 2026

Filed

This filing is one of 5 about the same incident.View merged incident

A leak claim by abyss about this victim predates this filing by 262 days.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Siteabyssbd_c7a2355c83e692c52025-04-21 · +262dVerified by operator

Regulatory filings (3) · sorted by filing gap

Vermont State AGbd_aeb905d46a06b7892026-01-07 · +1dVerified by operator
Nebraska State AGbd_710582e1991b1b4d2025-04-18 · +265dVerified
Indiana State AGbd_f4705ae9733e7d4a2025-04-18 · +265dVerified by operator

Name: Brett-Robinson
norm: brett robinson
Domain: brett-robinson.com

Name: Brett-Robinson
norm: brett robinson
Domain: brett-robinson.com
Industry: Retail & Consumerllm

Discovered: —
Breach occurred: Mar 26, 2025 – Apr 21, 2025
Materiality determined: —
Notification sent: Jan 7, 2026
Affected individuals: 2state-resident count only
Data types: Financial accountHealth (basic)Identity (basic)Government IDPCI
Data elements: Social Security number
Attack vector: Unknown

During the incident: Commenced a prompt and thorough investigation
Working closely with external cybersecurity professionals
Offering complimentary 24 months membership of Single Bureau Credit Monitoring/Single Bureau Credit Report/Single Bureau Credit Score services at no charge
Providing proactive fraud assistance
Set up a dedicated and confidential toll-free response line
Changes made: Continually evaluates and modifies its practices and internal controls to enhance the security and privacy of personal information
Source: Quoted from the filing itself, not independently verified.

Compliance flags: Leak >180d
Discovery-date grounding: no discovery dateNo discovery date was extracted, so no notification clock can be evaluated.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Nebraska State AGApr 18 · first

Indiana State AGApr 18 · first

Vermont State AG+264d

Massachusetts State AG+265d · this page

Pattern: first filing Apr 18 (NE), last Jan 8 (MA) — a 265-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.mass.gov/doc/2026-28-brett-robinson-vacation-rentals/download
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 8, 2026
Raw hash: fcee00a3009018d3ed6ac60b1ad0dc1120da32e2b55fbfd5378c959c52b36f42

Linked disclosures

Ransomware claims (1)

Regulatory filings (3) · sorted by filing gap

Reporting entityBrett-Robinson

Victim entityBrett-Robinson

IncidentUnknown

Stated responseCommenced a prompt and thorough investigation

ComplianceLeak >180d

Extraction provenanceno artifact recorded

Source provenancewww.mass.gov