HackingRetail & ConsumerRetailCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDHighContained

New TSI Holdings, Inc./New York Sports Club

bd_385384a57b9bbeae · schema v1 · pii pii-v1

Severity

High

Discovered

Jul 28, 2024

Filed

Sep 26, 2024

To disclose

9 weeks

Affected · nationwide

19,83620 in this filing

Linked

5 filings

Confidence

65%

Full breach record for New TSI Holdings, Inc./New York Sports Club →

New TSI Holdings, Inc./New York Sports Club reported an external system breach (hacking) on July 27, 2024, discovered July 28, 2024. Approximately 19,836 individuals were affected, including 20 Maine residents. Compromised data included names, Social Security numbers, and passport numbers. The company changed passwords, enhanced security, and offered 12 months of identity protection services.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Jul 28, 2024 → Filed with AG Sep 26, 202460d ⏱ ME AG >30d9 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 1 days

discovery → filing · 9 weeks / 60 days

Jul 27, 2024

Begins

Jul 28, 2024

Discovered

Sep 26, 2024

Filed

vs. sector median

+1 wks slower

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

California State AGbd_147073b7a8219df52024-09-26Verified
New Hampshire State AGbd_2fc1b3f24e8609eb2024-09-26Verified
Indiana State AGbd_315179cbe30948c62024-09-26Verified
Massachusetts State AGbd_3afbac3287e363e02024-09-27 · +1dVerified

Name: Kaufman Dolowich, LLP
norm: kaufman dolowich

Name: New TSI Holdings, Inc./New York Sports Club
norm: new tsi holdings inc new york sports club
Industry: Retail & Consumerllm

Discovered: Jul 28, 2024
Breach occurred: Jul 27, 2024
Undetected for: 1 dayoccurrence → discovery
Materiality determined: —
Notification sent: Sep 26, 2024
Affected individuals: 19,836state + nationwide
Data types: Identity (basic)Government ID
Data elements: Social Security number
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1078 Valid Accounts
Threat actor: External
Initial access: exploit_public_facing

During the incident: Changed all passwords for servers and email accounts
Continuing to actively monitor the servers and email accounts
Enhanced network security features
Implementing multi-factor authentication on systems
Offering identity theft protection services through IDX
Changes made: Enhanced network security features
Implementing multi-factor authentication on systems
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 9 weeks(60 days from discovery to filing)
Compliance flags: ME AG >30d · 60d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Jul 28, 2024
→ Filed with AG: Sep 26, 2024
60d 30 days (soft) ME AG >30d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Jul 28, 2024 → Filed with AG: Sep 26, 2024	60d	30 days (soft)	ME AG >30d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

California State AGSep 26 · first

New Hampshire State AGSep 26 · first

Indiana State AGSep 26 · first

Maine State AGSep 26 · first · this page

Massachusetts State AG+1d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/8ab8a432-f981-4cac-a826-c3379af30549.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 26, 2024
Raw hash: 820199cd6d52bd62c1282c1fc871436a767b802b304785a8666a7c0079eb4524

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityKaufman Dolowich, LLP

Victim entityNew TSI Holdings, Inc./New York Sports Club

Incidentdiscovered Jul 28, 2024

Stated responseChanged all passwords for servers and email accounts

ComplianceME AG >30d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov