HackingOtherData ExfiltratedCustomer Data InvolvedIdentity (basic)MediumContained

Global Volunteers

bd_589fb1c9966bc0ed · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jun 29, 2024

Filed

Aug 21, 2024

To disclose

8 weeks

Affected · nationwide

1,2946 in this filing

Linked

6 filings

Confidence

66%

Full breach record for Global Volunteers →

Global Volunteers, a non-profit organization, disclosed an external system breach (hacking) occurring between September 19 and 26, 2023. The incident was discovered on June 29, 2024, after a comprehensive investigation. Approximately 1,294 individuals were affected, including 6 Maine residents. The breach involved unauthorized access and data download, impacting basic identity information. Global Volunteers engaged cybersecurity specialists, reported the event to federal law enforcement, and provided 24 months of credit monitoring and identity theft protection services through Experian to affected individuals.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Jun 29, 2024 → Filed with AG Aug 21, 202453d ⏱ ME AG >30d8 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 284 days

discovery → filing · 8 weeks / 53 days

Sep 19, 2023

Begins

Jun 29, 2024

Discovered

Aug 21, 2024

Filed

vs. sector median

on median

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Vermont State AGbd_01f46920e57309b82024-08-21Verified
New Hampshire State AGbd_3991cc161064476e2024-08-21Verified
Massachusetts State AGbd_8caecca546c8e64b2024-08-21Verified
Montana State AGbd_da43dfa9503801992024-08-21Verified

Show 1 more filing ↓up to 5d gap

Indiana State AGbd_26988a6a7c6a73f32024-08-16 · +5dVerified

Name: Global Volunteers
norm: global volunteers
Domain: globalvolunteers.org

Name: Global Volunteers
norm: global volunteers
Domain: globalvolunteers.org
Industry: Otherllm

Discovered: Jun 29, 2024
Breach occurred: Sep 19, 2023 – Sep 26, 2023
Undetected for: 284 daysoccurrence → discovery
Materiality determined: —
Notification sent: Aug 21, 2024
Affected individuals: 1,294state + nationwide
Data types: Identity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: reported the event to federal law enforcement
Initial access: exploit_public_facing

During the incident: Launched a comprehensive investigation with the assistance of cybersecurity specialists
Performed a time-intensive third-party review of the impacted files
Undertook a detailed internal review of our records
Reported the event to federal law enforcement
Offering you access to 24 months of credit monitoring and identity theft protection services through Experian at no cost to you
Changes made: Evaluating our technical and administrative safeguards
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 weeks(53 days from discovery to filing)
Compliance flags: ME AG >30d · 53d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Jun 29, 2024
→ Filed with AG: Aug 21, 2024
53d 30 days (soft) ME AG >30d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Jun 29, 2024 → Filed with AG: Aug 21, 2024	53d	30 days (soft)	ME AG >30d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

Indiana State AGAug 16 · first

Vermont State AG+5d

New Hampshire State AG+5d

Massachusetts State AG+5d

Montana State AG+5d

Maine State AG+5d · this page

Pattern: first filing Aug 16 (IN), last Aug 21 (ME) — a 5-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/183c979d-f04b-49b7-b37f-859ad0b52ffb.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 21, 2024
Raw hash: 42990f489e745cef15a7230cd341c6db3966b82dd5afba3b15a719a5e4fd46d4

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityGlobal Volunteers

Victim entityGlobal Volunteers

Incidentdiscovered Jun 29, 2024

Stated responseLaunched a comprehensive investigation with the assistance of cybersecurity specialists

ComplianceME AG >30d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov