MisuseOtherData MishandlingEmployee Data InvolvedPIIIdentity (basic)EmploymentLowResolved

Sierra Club

bd_6210b1910769410b · schema v1 · pii pii-v1

Severity

Low

Discovered

—

Filed

Oct 5, 2023

To disclose

—

Affected

2state residents only

Linked

6 filings

Confidence

66%

Full breach record for Sierra Club →

Sierra Club notified the New Hampshire Attorney General that a former employee forwarded a file containing personal information for certain Sierra Club employees to their personal email account on or about February 3, 2023. The activity was discovered during a security audit. Two New Hampshire residents were affected. The employee was terminated. Sierra Club is offering credit monitoring services through Experian and has notified relevant regulators and credit bureaus.

J jump to incidentP pin to compareR raw source

Incident timeline

Feb 3, 2023

Begins

Oct 5, 2023

Filed

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Maine State AGbd_0817cb1dfc1ba95f2023-10-05Candidate
Vermont State AGbd_2424595bc8ca2c332023-10-05Verified
Massachusetts State AGbd_a5fa06c873e923342023-10-05Verified
Montana State AGbd_dfe987f053485cfe2023-10-05Verified

Show 1 more filing ↓up to 1d gap

Indiana State AGbd_cf1225f15684e8b82023-10-04 · +1dVerified

Name: Sierra Club
norm: sierra club

Name: Sierra Club
norm: sierra club
Industry: Otherllm

Discovered: —
Breach occurred: Feb 3, 2023
Materiality determined: —
Notification sent: Oct 4, 2023
Affected individuals: 2state-resident count only
Data types: PIIIdentity (basic)Employment
Attack vector: Insider
Threat actor: Internal
Regulator citations: Provided written notice to the New Hampshire Attorney GeneralProviding written notice to relevant state regulators, as necessary
Initial access: insider_action

During the incident: Launched an investigation to determine the scope of information involved
Took steps to mitigate the risk to the impacted file in accordance with internal policies and procedures
Terminated the employment of the individual responsible for the event
Provided access to credit monitoring services through Experian
Provided guidance on how to better protect against identity theft and fraud
Notified relevant state regulators
Notified the three major credit reporting agencies, Equifax, Experian, and TransUnion
Changes made: Provided access to credit monitoring and identity theft protection services through Experian
Provided guidance on how to better protect against identity theft and fraud
Advised individuals to report any suspected incidents of identity theft or fraud to their credit card company and/or bank
Provided information on how to place a fraud alert and security freeze on one’s credit file
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

Indiana State AGOct 4 · first

Maine State AG+1d

Vermont State AG+1d

Massachusetts State AG+1d

Montana State AG+1d

New Hampshire State AG+1d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/sierra-club-20231005.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 5, 2023
Raw hash: edbf860ca2117ad28a9bbcdf32257f7b0775f042d111d687c2f9e8a07fd8e054

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entitySierra Club

Victim entitySierra Club

IncidentInsider

Stated responseLaunched an investigation to determine the scope of information involved

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov