HackingIdentity (basic)Government IDFinancial accountHealth (basic)MediumContained

Yellow Corporation and affiliated debtors

bd_6d2401a4c9e58103 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Mar 27, 2025

Filed

Jun 26, 2026

To disclose

15 months

Affected

Not disclosed

Linked

2 filings

Confidence

64%

Full breach record for Yellow Corporation and affiliated debtors →

Yellow Corporation notified Washington AG of a data event on March 27, 2025, where unauthorized access led to the exfiltration of files containing PII, PHI, and financial data. Notification was provided via substitute notice (media/website) on June 26, 2026. Affected data includes SSN, DOB, driver's license, financial account, and medical info. Most data pertains to former employees. Credit monitoring offered.

J jump to incidentP pin to compareR raw source

Washington clock✗ WA AG >90d15 months discovery → filing

⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Incident timeline

discovery → filing · 15 months / 456 days

Mar 27, 2025

Begins

Mar 27, 2025

Discovered

Jun 26, 2026

Filed

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Vermont State AGbd_c46bc2220a0a55212026-06-26Candidate

Name: Yellow Corporation and affiliated debtors
norm: yellow corporation and affiliated debtors
Domain: myyellow.com

Name: Yellow Corporation and affiliated debtors
norm: yellow corporation and affiliated debtors
Domain: myyellow.com

Discovered: Mar 27, 2025
Breach occurred: Mar 27, 2025
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jun 26, 2026
Affected individuals: Not disclosed
Data types: Identity (basic)Government IDFinancial accountHealth (basic)
Data elements: Social Security numberDate of birthMedical information
Attack vector: Unauthorized Access
MITRE ATT&CK: T1119 Automated CollectionT1041 Exfiltration Over C2 Channel
Threat actor: External
Regulator citations: providing written notice of this incident to relevant state regulators

During the incident: Took the systems offline
Securely restored them from backups
Investigation, with the assistance of third-party cybersecurity specialists
Providing access to credit monitoring services for one (1) year, through TransUnion
Providing impacted individuals with guidance on how to better protect against identity theft and fraud
Providing written notice of this incident to relevant state regulators
Providing written notice... to the three major credit reporting agencies, Equifax, Experian, and TransUnion
Changes made: Evaluating additional technical security measures and processes to reduce the risk of an issue like this reoccurring
Implementing additional technical safeguards to mitigate the reoccurrence of this type of event
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 15 months(456 days from discovery to filing)
Compliance flags: WA AG >90d
Discovery-date grounding: occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Vermont State AGJun 26 · first

Washington State AGJun 26 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA41494.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 26, 2026
Raw hash: 3d0f9cc6c5b7951c91a9448fe71f6d198d1cc35e20a95c74ed12d352f96441a0

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityYellow Corporation and affiliated debtors

Victim entityYellow Corporation and affiliated debtors

Incidentdiscovered Mar 27, 2025

Stated responseTook the systems offline

ComplianceWA AG >90d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com