HackingTargetedIDENTITY_BASICLowContained
Central Boiler Companies, Inc.
bd_5f62d22566331efc · schema v1 · pii pii-v1
Full breach record for Central Boiler Companies, Inc. →Central Boiler, Inc. notified consumers of a cyber security incident discovered on August 1, 2025, involving unauthorized access to customer data including names and combination data elements. The company engaged forensic specialists, reported to federal law enforcement, and offered credit monitoring via Epiq. The incident is considered targeted.
Vermont clock✗ VT AG >45 bday14 weeks discovery → filing
⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
This filing is one of 5 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (4) · sorted by filing gap
- bd_37d56cc45e074d73New Hampshire State AGfiled 2025-11-05Verified
- bd_6555b10729ed64b4Montana State AGfiled 2025-11-05Verified
- bd_a7f9e0855940fbf4Maine State AGfiled 2025-11-05Verified
- bd_5eb2d71903910893Indiana State AGfiled 2025-09-29(37d gap)Candidate
Source provenance
- Source URL
- https://ago.vermont.gov/document/2025-11-05-central-boiler-companies-data-breach-notice-consumers
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Nov 5, 2025
- Raw hash
- 1e7a7703ab671374c5579102d37da1810e36fe982c1950586575a0c13ec7694a
Reporting entity
- Name
- Central Boiler Companies, Inc.norm: central boiler companies
Victim entity
- Name
- Central Boiler Companies, Inc.norm: central boiler companies
Incident
- Discovered
- Aug 1, 2025
- Materiality determined
- —
- Notification sent
- Nov 5, 2025
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_BASIC
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1190 Exploit Public-Facing Application
- Threat actor
- External
- Regulator citations
- Reported this incident to federal law enforcement
- Initial access
- exploit_public_facing
Compliance
- Time to disclose
- 14 weeks(96 days from discovery to filing)
- Compliance flags
- VT AG >45 bday
- Discovery-date grounding
- unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.