HackingOtherData ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDMediumContained

Peter Pauper Press

bd_41ac449d84973f70 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jan 25, 2025

Filed

Aug 18, 2025

To disclose

29 weeks

Affected

Not disclosed

Linked

3 filings

Confidence

66%

Full breach record for Peter Pauper Press →

Peter Pauper Press notified consumers of unauthorized access to its computer network on or around January 25, 2025. The company determined that files containing names and Social Security numbers may have been copied without permission on or before that date. A comprehensive review was completed on June 10, 2025. The company is offering complimentary identity monitoring services and has stated it will evaluate policies and security measures to prevent recurrence. The notice mentions residents of Vermont, Maryland, New Mexico, New York, North Carolina, and Rhode Island.

J jump to incidentP pin to compareR raw source

Vermont clock✗ VT AG >45 bday29 weeks discovery → filing

Incident timeline

discovery → filing · 29 weeks / 205 days

Jan 25, 2025

Discovered

Aug 18, 2025

Filed

vs. sector median

+21 wks slower

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

New Hampshire State AGbd_bb180368659334342025-08-19 · +1dVerified
Massachusetts State AGbd_c4d36f828c0117ff2025-08-19 · +1dVerified

Name: Peter Pauper Press
norm: peter pauper press

Name: Peter Pauper Press
norm: peter pauper press
Industry: Otherllm

Discovered: Jan 25, 2025
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: Identity (basic)Government ID
Attack vector: Unknown
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External

During the incident: Took steps to verify the security of our computer network
Completed a comprehensive review to determine file contents and affected individuals
Notifying individuals about this matter
Providing guidance about free resources for monitoring accounts and credit reports
Offering complimentary identity monitoring services
Changes made: Continue to evaluate our policies, procedures, staff training, and technical security measures to reduce the likelihood of an event like this reoccurring
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 29 weeks(205 days from discovery to filing)
Compliance flags: VT AG >45 bday
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Vermont State AGAug 18 · first · this page

New Hampshire State AG+1d

Massachusetts State AG+1d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ago.vermont.gov/document/2025-08-18-peter-pauper-press-data-breach-notice-consumers
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 18, 2025
Raw hash: 8e23cfe25c16921f366910622d3e68afa581cd8dea4c6bb48b409e81c8dd5daa

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityPeter Pauper Press

Victim entityPeter Pauper Press

Incidentdiscovered Jan 25, 2025

Stated responseTook steps to verify the security of our computer network

ComplianceVT AG >45 bday

Extraction provenanceno artifact recorded

Source provenanceago.vermont.gov