PhysicalFinancial ServicesFinanceLossCustomer Data InvolvedIdentity (basic)Government IDFinancial accountHighResolved

Vermont State Employees Credit Union

bd_448a14b5e3a6672a · schema v1 · pii pii-v1

Severity

High

Discovered

Sep 10, 2012

Filed

Oct 23, 2012

To disclose

6 weeks

Affected

1,544state residents only

Confidence

66%

Full breach record for Vermont State Employees Credit Union →2 incidents on file

Vermont State Employees Credit Union (VSECU) notified the NH Attorney General on Oct 23, 2012, regarding the loss of two unencrypted backup tapes created on Aug 27, 2012. Discovered Sept 10, 2012, the tapes contained names, SSNs, driver's licenses, and financial account info. VSECU believes the tapes were mistakenly discarded in a landfill. No evidence of theft or improper access was found. Approximately 1,544 NH residents were notified, and affected individuals were offered one year of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 14 days

discovery → filing · 6 weeks / 43 days

Aug 27, 2012

Begins

Sep 10, 2012

Discovered

Oct 23, 2012

Filed

vs. sector median

2 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed1,544 affectedView incident

Name: Vermont State Employees Credit Union
norm: vermont state employees credit union
Domain: vsecu.com
Industry: financial_services

Name: Vermont State Employees Credit Union
norm: vermont state employees credit union
Domain: vsecu.com
Industry: financial_services
Industry: Financial Servicesllm

Discovered: Sep 10, 2012
Breach occurred: Aug 27, 2012
Undetected for: 14 daysoccurrence → discovery
Materiality determined: —
Notification sent: Oct 23, 2012
Affected individuals: 1,544state-resident count only
Data types: Identity (basic)Government IDFinancial account
Data elements: Social Security number
Attack vector: Unknown
MITRE ATT&CK: T1052 Exfiltration Over Physical Medium
Regulator citations: Regular communication with regulators and law enforcement officials

During the incident: Started a thorough search and an investigation into what happened to the backup tapes
Notifying all individuals with information on the backup tapes
Offering eligible individuals one year of free credit monitoring and identity theft protection services provided by TransUnion Interactive
Conducting a comprehensive internal review of its practices and procedures to help prevent something like this from happening again
Verifying that all new backup tapes are encrypted according to VSECU policy
Communicating with regulators and law enforcement officials
Changes made: Verifying that all new backup tapes are encrypted according to VSECU policy
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 weeks(43 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/vermont-credit-union-20121023.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 23, 2012
Raw hash: 51048d93e62142df4ddeb27ecf292c42ac4a6b4b3de7388355f8beb8dd885eca

Reporting entityVermont State Employees Credit Union

Victim entityVermont State Employees Credit Union

Incidentdiscovered Sep 10, 2012

Stated responseStarted a thorough search and an investigation into what happened to the backup tapes

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov