HackingTargetedIDENTITY_BASICIDENTITY_GOVERNMENTMediumContained
Itasca Consulting Group
bd_415383468576abdb · schema v1 · pii pii-v1
Full breach record for Itasca Consulting Group →Itasca Consulting Group notified Vermont AG of a December 12, 2025 unauthorized access incident affecting employee and family member data including names, SSNs, DOBs, and driver's licenses. Forensic investigation concluded Jan 9, 2026. No evidence of misuse found. Credit monitoring offered.
Vermont clock⏱ VT AG >14 bday6 weeks discovery → filing
⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident
A leak claim by akira about this victim predates this filing by 42 days.View originating leak claim
Source provenance
- Source URL
- https://ago.vermont.gov/document/2026-01-23-itasca-consulting-group-data-breach-notice-consumers
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Jan 23, 2026
- Raw hash
- 032b258ec0e20d1555c6f12568a744f6515076f648c5565a7697626fd0e4a81a
Reporting entity
- Name
- Itasca Consulting Groupnorm: itasca consulting
- Domain
- itascacg.com
Victim entity
- Name
- Itasca Consulting Groupnorm: itasca consulting
- Domain
- itascacg.com
Incident
- Discovered
- Dec 12, 2025
- Materiality determined
- —
- Notification sent
- Jan 23, 2026
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENT
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1190 Exploit Public-Facing Application
- Threat actor
- External
- Initial access
- exploit_public_facing
Compliance
- Time to disclose
- 6 weeks(42 days from discovery to filing)
- Compliance flags
- VT AG >14 bdayLeak >30d
- Discovery-date grounding
- unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.