Social EngineeringPhishingStolen CredentialsTargetedIDENTITY_BASICIDENTITY_GOVERNMENTMediumContained
Champlain Valley Office of Economic Opportunity
bd_4e998d7cbeed5f92 · schema v1 · pii pii-v1
Full breach record for Champlain Valley Office of Economic Opportunity →Champlain Valley Office of Economic Opportunity (CVOEO) notified Vermont residents of a security incident involving unauthorized access to a single employee email account between March 7-14, 2025. The attacker, likely via phishing, accessed emails containing personal information including names, addresses, SSNs, and dates of birth. CVOEO engaged forensic specialists, secured the account, and is reviewing security policies. No identity theft was confirmed.
Vermont clock✗ VT AG >45 bday12 weeks discovery → filing
⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident
Source provenance
- Source URL
- https://ago.vermont.gov/document/2025-05-28-champlain-valley-office-economic-opportunity-data-breach-notice-consumers
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- May 28, 2025
- Raw hash
- 662fd18bf7892748b643335dd183f554bbf6df4d7e4f37af70bce6b61d4f42b7
Reporting entity
- Name
- Champlain Valley Office of Economic Opportunitynorm: champlain valley office of economic opportunity
Victim entity
- Name
- Champlain Valley Office of Economic Opportunitynorm: champlain valley office of economic opportunity
Incident
- Discovered
- Mar 7, 2025
- Materiality determined
- —
- Notification sent
- May 28, 2025
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENT
- Attack vector
- Phishing
- MITRE ATT&CK
- T1566.002 Spearphishing LinkT1078 Valid Accounts
- Threat actor
- External
- Initial access
- phishing_link
Compliance
- Time to disclose
- 12 weeks(82 days from discovery to filing)
- Compliance flags
- VT AG >45 bday
- Discovery-date grounding
- occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.