HackingTargetedIDENTITY_BASICLowContained
CrossCheck, Inc.
bd_36572c993024a895 · schema v1 · pii pii-v1
Full breach record for CrossCheck, Inc. →CrossCheck, Inc. notified consumers of a data breach affecting its merchant portal. Between May 18-20, 2024, an unauthorized actor accessed the portal, exposing names and limited personal data. CrossCheck reported the incident to federal law enforcement, enhanced network security policies, and offered complimentary credit monitoring to affected individuals. The notice was filed with the Vermont Attorney General on March 4, 2025.
Vermont clock✗ VT AG >45 bday41 weeks discovery → filing
⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
This filing is one of 5 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (4) · sorted by filing gap
- bd_8403863b44be3ba0Montana State AGfiled 2025-03-04Candidate
- bd_bcb09ac65f4f2fcbMaine State AGfiled 2025-03-04Verified by operator
- bd_eb17d64cf01f2672Vermont State AGfiled 2025-03-04Verified
- bd_eb70bd43a1a1c799Indiana State AGfiled 2025-03-04Verified
Source provenance
- Source URL
- https://ago.vermont.gov/document/2025-03-04-crosscheck-data-breach-notice-consumers
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Mar 4, 2025
- Raw hash
- 8b4cd9735563bfa11c2dfbf9b379c95de867eea735bb1c98a055d31512f742cc
Reporting entity
- Name
- CrossCheck, Inc.norm: crosscheck
Victim entity
- Name
- CrossCheck, Inc.norm: crosscheck
Incident
- Discovered
- May 20, 2024
- Materiality determined
- Mar 4, 2025
- Notification sent
- Mar 4, 2025
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_BASIC
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1190 Exploit Public-Facing Application
- Threat actor
- External
- Regulator citations
- Reported this event to federal law enforcement
- Initial access
- exploit_public_facing
Compliance
- Time to disclose
- 41 weeks(288 days from discovery to filing)
- Compliance flags
- VT AG >45 bday
- Discovery-date grounding
- unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.