HackingDelayed DiscoveryIDENTITY_BASICLowContained
Dulcich, Inc.
bd_4ec290f1d656cd5f · schema v1 · pii pii-v1
Full breach record for Dulcich, Inc. →Dulcich, Inc. notified consumers of a data breach where unauthorized access to its network occurred between June 24-25, 2024. The incident involved access to personal information including full names. Dulcich contained the incident, engaged forensic investigators, and notified the FBI. Consumers were offered complimentary credit monitoring. The breach was determined material on September 29, 2025.
Vermont clock✗ VT AG >45 bday16 months discovery → filing
⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
This filing is one of 9 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (8) · sorted by filing gap
- bd_0216d6506e680296Maine State AGfiled 2025-10-14Candidate
- bd_1239faefddba161cMontana State AGfiled 2025-10-14Verified
- bd_3a0e057df921610dOregon State AGfiled 2025-10-14Verified
- bd_551f06b9dc1db169Washington State AGfiled 2025-10-14Verified
Show 4 more filings ↓Show fewer ↑up to 6d gap
- bd_d6aac9753c52fa00Indiana State AGfiled 2025-10-14Verified
- bd_eaf989bf564b5f80California State AGfiled 2025-10-14Verified
- bd_367e3fa6887321c6Texas State AGfiled 2025-10-16(2d gap)Verified
- bd_61fef1f061261ef6New Hampshire State AGfiled 2025-10-20(6d gap)Verified
Source provenance
- Source URL
- https://ago.vermont.gov/document/2025-10-14-dulcich-data-breach-notice-consumers
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Oct 14, 2025
- Raw hash
- 76004f2037fc70dfeee55e2d63366c3094465e846351d7793b0133803b51a63e
Reporting entity
- Name
- Dulcich, Inc.norm: dulcich
Victim entity
- Name
- Dulcich, Inc.norm: dulcich
Incident
- Discovered
- Jun 24, 2024
- Materiality determined
- Sep 29, 2025
- Notification sent
- Oct 14, 2025
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_BASIC
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1190 Exploit Public-Facing Application
- Threat actor
- External
- Regulator citations
- Reported the incident to the Federal Bureau of Investigation
- Initial access
- exploit_public_facing
Compliance
- Time to disclose
- 16 months(477 days from discovery to filing)
- Compliance flags
- VT AG >45 bday
- Discovery-date grounding
- occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.