HackingOtherData ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDMediumContained

Chevy Chase Club, Inc.

bd_61a06e20204984a9 · schema v1 · pii pii-v2

Severity

Medium

Discovered

May 29, 2026

Filed

Oct 19, 2026

To disclose

20 weeks

Affected

5state residents only

Linked

2 filings

Confidence

70%

Full breach record for Chevy Chase Club, Inc. →

Chevy Chase Club notified the NH Attorney General of unauthorized access to its computer systems between March 28, 2026, and May 29, 2026. The incident was discovered on May 29, 2026. Files were accessed and/or copied without authorization. The incident affected 5 New Hampshire residents, whose first and last names and Social Security numbers were potentially impacted. The Club engaged third-party specialists, notified law enforcement, and offered credit monitoring services.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 62 days

discovery → filing · 20 weeks / 143 days

Mar 28, 2026

Begins

May 29, 2026

Discovered

Oct 19, 2026

Filed

vs. sector median

+15 wks slower

This filing is one of 2 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Vermont State AGbd_f1728abefa0a62332026-10-20 · +1dCandidate

Name: Chevy Chase Club
norm: chevy chase club
Domain: kla.com

Name: Chevy Chase Club, Inc.
norm: chevy chase club
Industry: Otherllm

Discovered: May 29, 2026
Breach occurred: Mar 28, 2026 – May 29, 2026
Undetected for: 62 daysoccurrence → discovery
Materiality determined: —
Notification sent: Oct 19, 2026
Affected individuals: 5state-resident count only
Data types: Identity (basic)Government ID
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1041 Exfiltration Over C2 Channel
Threat actor: External
Regulator citations: Notified New Hampshire Office of the Attorney GeneralNotified federal law enforcement

During the incident: Engaged third-party specialists to determine the nature and scope of the event
Engaged additional specialists to conduct a detailed review of the potentially impacted information
Engaged a notice assistance vendor to conduct address append services
Performed a National Change of Address (NCOA) search
Notified federal law enforcement regarding this matter
Notified requisite regulatory authorities
Offered complimentary access to credit monitoring services and a dedicated call center
Changes made: Reviewed and enhanced its data security policies and procedures related to data security and cybersecurity
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 20 weeks(143 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

New Hampshire State AGOct 19 · first · this page

Vermont State AG+1d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/chevy-chase-club-20261019.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 19, 2026
Raw hash: a3b48e22168a0ac32aa39029a99217d08c3712cdd6eb12a0651ea4f1ae422164

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityChevy Chase Club

Victim entityChevy Chase Club, Inc.

Incidentdiscovered May 29, 2026

Stated responseEngaged third-party specialists to determine the nature and scope of the event

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov