Social EngineeringHealthcareProfessional ServicesHealthcarePhishingStolen CredentialsCustomer Data InvolvedEmployee Data InvolvedPIIPHIIdentity (basic)Health (basic)LowContained

Family Counseling Services of the Finger Lakes

bd_68f0583ed1ca241a · schema v1 · pii pii-v1

Severity

Low

Discovered

Jun 30, 2025

Filed

Aug 22, 2025

To disclose

8 weeks

Affected

Not disclosed

Linked

2 filings

Confidence

66%

Full breach record for Family Counseling Services of the Finger Lakes →

Family Counseling Services of the Finger Lakes notified consumers of a cybersecurity incident where unauthorized actors accessed limited employee email accounts between Jan 14 and Feb 4, 2025. The incident involved personal and protected health information. The organization engaged external cybersecurity professionals and is offering credit monitoring and fraud assistance.

J jump to incidentP pin to compareR raw source

Vermont clock⏱ VT AG >14 bday8 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 167 days

discovery → filing · 8 weeks / 53 days

Jan 14, 2025

Begins

Jun 30, 2025

Discovered

Aug 22, 2025

Filed

vs. sector median

5 wks faster

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Indiana State AGbd_dfbc6f0e31e3ae912025-08-25 · +3dVerified

Name: Family Counseling Services of the Finger Lakes
norm: family counseling services of the finger lakes

Name: Family Counseling Services of the Finger Lakes
norm: family counseling services of the finger lakes
Industry: HealthcarellmProfessional Servicesllm

Discovered: Jun 30, 2025
Breach occurred: Jan 14, 2025 – Feb 4, 2025
Undetected for: 167 daysoccurrence → discovery
Materiality determined: —
Notification sent: Aug 22, 2025
Affected individuals: Not disclosed
Data types: PIIPHIIdentity (basic)Health (basic)
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid Accounts
Threat actor: External
Initial access: phishing_link

During the incident: Immediately took steps to secure our email environment
Commenced a prompt and thorough investigation
Working very closely with external cybersecurity professionals
Manual document review
Providing you with credit monitoring services at no charge
Providing you with proactive fraud assistance
Set up a dedicated and confidential toll-free response line
Changes made: Continually evaluate and modify our practices and internal controls to enhance the security and privacy of your information
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 weeks(53 days from discovery to filing)
Compliance flags: VT AG >14 bday
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Vermont State AGAug 22 · first · this page

Indiana State AG+3d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ago.vermont.gov/document/2025-08-22-family-counseling-services-finger-lakes-data-breach-notice-consumers
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 22, 2025
Raw hash: 4d11274f125add9f51da2133484fec1c3c0e0016afac16c1c49e156859910088

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityFamily Counseling Services of the Finger Lakes

Victim entityFamily Counseling Services of the Finger Lakes

Incidentdiscovered Jun 30, 2025

Stated responseImmediately took steps to secure our email environment

ComplianceVT AG >14 bday

Extraction provenanceno artifact recorded

Source provenanceago.vermont.gov