New York City Bar Association
bd_4bef76b165b44a09 · schema v1 · pii pii-v2
Full breach record for New York City Bar Association →4 incidents on fileThe Association of the Bar of the City of New York notified members of a data privacy event involving a third-party software platform used for member engagement and online payments. On July 14, 2026, the City Bar learned of a payment card skimming incident by an unknown individual. The investigation determined that personal information, including names, credit/debit card numbers, and CVV codes, may have been acquired between April 27, 2026, and July 28, 2026. The City Bar engaged a cybersecurity forensics firm, secured systems, and notified law enforcement. The third-party platform retains the affected data.
J jump to incidentP pin to compareR raw source
Incident timeline
Apr 27, 2026
Begins
Jul 14, 2026
Discovered
Sep 1, 2026
Filed
Linked disclosures
Why this link?Regulatory filings (3) · sorted by filing gap
- Vermont State AGbd_7d65dd394d4775f12026-09-29 · +28dVerified
- Indiana State AGbd_8be1469c01c290f12026-09-29 · +28dVerified
- New Hampshire State AGbd_ad70aaada17271002026-09-29 · +28dVerified
Filing propagation · 4 filings · 4 states
View merged incident ↗Pattern: first filing Sep 1 (MA), last Sep 29 (NH) — a 28-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?
Evidence ladder
Attacker assertion only. Establishes: claim date, group, alleged victim.
Unlocks: incident narrative, operational impact. Still no compliance clock.
Unlocks: discovery date, data types, affected count, compliance clock.
Unlocks: materiality, stated response, full audit trail. Ceiling removed.