Social EngineeringPhishingStolen CredentialsCustomer Data InvolvedEmployee Data InvolvedIDENTITY_BASICCREDENTIALSLowContained
YMCA of the USA
bd_3a63bf365c60e251 · schema v1 · pii pii-v1
Full breach record for YMCA of the USA →YMCA of Greater Hartford notified individuals of a data breach involving a compromised employee email account. Unauthorized access occurred between July 27 and August 8, 2023, following suspicious activity detected on August 8. The incident involved phishing leading to credential compromise. Affected data included names and other personal information. The organization reset credentials, investigated the incident, and offered 24 months of Experian IdentityWorks.
Vermont clock⏱ VT AG >14 bday7 weeks discovery → filing
⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident
Source provenance
- Source URL
- https://ago.vermont.gov/document/2023-09-27-ymca-metropolitan-hartford-data-breach-notice-consumerspdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Sep 27, 2023
- Raw hash
- 9a86c8d634411a56192d6470e2f62947875bc425f32fa6891ef8153dde2c3cad
Reporting entity
- Name
- YMCA of the USAnorm: ymca of the usa
- Domain
- ymca.org
Victim entity
- Name
- YMCA of the USAnorm: ymca of the usa
- Domain
- ymca.org
Incident
- Discovered
- Aug 8, 2023
- Materiality determined
- —
- Notification sent
- Sep 26, 2023
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_BASICCREDENTIALS
- Attack vector
- Phishing
- MITRE ATT&CK
- T1566.002 Spearphishing LinkT1078 Valid Accounts
- Threat actor
- External
- Initial access
- phishing_link
Compliance
- Time to disclose
- 7 weeks(50 days from discovery to filing)
- Compliance flags
- VT AG >14 bday
- Discovery-date grounding
- unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.