AccidentalMisdeliveryCustomer Data InvolvedIDENTITY_BASICIDENTITY_GOVERNMENTFINANCIALMediumResolved
C&S WHOLESALE GROCERS, INC.
bd_5d71b82c4e536d5f · schema v1 · pii pii-v1
Full breach record for C&S WHOLESALE GROCERS, INC. →C&S Wholesale Grocers, LLC accidentally mailed W2 forms containing names, SSNs, and tax info to incorrect individuals in January 2025 due to a mail merge error. The company notified unintended recipients, regulators, and offered IDX identity protection services. No evidence of misuse was found.
Vermont clock⏱ VT AG >14 bday8 weeks discovery → filing
⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
This filing is one of 4 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (3) · sorted by filing gap
- bd_3263cf801fe45b16Maine State AGfiled 2025-02-26Candidate
- bd_603041aab654e3f8New Hampshire State AGfiled 2025-02-26Verified
- bd_42745efcaf1fced4Maryland State AGfiled 2025-02-25(1d gap)Verified
Source provenance
- Source URL
- https://ago.vermont.gov/document/2025-02-26-cs-wholesale-grocers-data-breach-notice-consumers
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Feb 26, 2025
- Raw hash
- 8f5b4c9573404e8d16a2218300c9fc32e21c533effea82f98dd10b01228238f0
Reporting entity
- Name
- C&S WHOLESALE GROCERS, INC.norm: c s wholesale grocers
Victim entity
- Name
- C&S WHOLESALE GROCERS, INC.norm: c s wholesale grocers
Incident
- Discovered
- Jan 1, 2025
- Materiality determined
- —
- Notification sent
- Feb 26, 2025
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENTFINANCIAL
- Attack vector
- Misconfiguration
- MITRE ATT&CK
- T1566 Phishing
- Regulator citations
- Notifying the relevant regulators of the error
Compliance
- Time to disclose
- 8 weeks(56 days from discovery to filing)
- Compliance flags
- VT AG >14 bday
- Discovery-date grounding
- occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.