Social EngineeringOtherPhishingStolen CredentialsCustomer Data InvolvedPIIIdentity (basic)LowContained

YMCA of Columbia-Willamette

bd_5cdb9231502798d0 · schema v1 · pii pii-v1

Severity

Low

Discovered

—

Filed

Mar 27, 2020

To disclose

—

Affected

1state residents only

Linked

2 filings

Confidence

66%

Full breach record for YMCA of Columbia-Willamette →

YMCA of Columbia-Willamette notified individuals of unauthorized access to an employee email account between Dec 19-27, 2019. The incident likely resulted from phishing. Personal information was present in the account. No misuse was detected. The company reset passwords, engaged forensic investigators, and offered 12 months of identity monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

Dec 19, 2019

Begins

Mar 27, 2020

Filed

This filing is one of 2 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Oregon State AGbd_84d1294e31386f492020-03-27Verified

Name: YMCA of Columbia-Willamette
norm: ymca of columbia willamette

Name: YMCA of Columbia-Willamette
norm: ymca of columbia willamette
Industry: Otherllm

Discovered: —
Breach occurred: Dec 19, 2019 – Dec 27, 2019
Materiality determined: —
Notification sent: Mar 20, 2020
Affected individuals: 1state-resident count only
Data types: PIIIdentity (basic)
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid AccountsT1114 Email Collection
Threat actor: External
Initial access: phishing_link

During the incident: Moved quickly to investigate and respond to this incident
Resetting the account password
Reviewing the contents of the email account to determine whether it contained protected information
Reviewing internal systems to identify contact information for purposes of providing notice to potentially affected individuals
Offering you access to twelve (12) months of identity monitoring services through Kroll at no cost to you
Changes made: Reviewing and enhancing existing policies and procedures to reduce the likelihood of a similar future event
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Oregon State AGMar 27 · first

Montana State AGMar 27 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/General-Notice-77.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 27, 2020
Raw hash: e94a6a94a2a7758d08d772a5cfac07f5721a77914bd831f527a89886df77b2c5

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityYMCA of Columbia-Willamette

Victim entityYMCA of Columbia-Willamette

IncidentPhishing

Stated responseMoved quickly to investigate and respond to this incident

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov