HackingCustomer Data InvolvedIDENTITY_BASICIDENTITY_GOVERNMENTMediumContained
Graebel Companies, Inc.
bd_73c177814cb98cef · schema v1 · pii pii-v1
Full breach record for Graebel Companies, Inc. →Graebel Companies, Inc. filed a supplemental notice with the Vermont AG regarding a December 2024 cybersecurity incident. The breach affected client data, including names and government IDs, impacting at least 4 Vermont residents. Graebel secured its network, engaged in investigation, notified federal law enforcement, and offered 24 months of credit monitoring via TransUnion.
Vermont clock✗ VT AG >45 bday16 months discovery → filing
⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
This filing is one of 2 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (1) · sorted by filing gap
- bd_8c8a4e0cfc33cf0eNew Hampshire State AGfiled 2026-04-03Verified
Source provenance
- Source URL
- https://ago.vermont.gov/document/2026-04-03-graebel-companies-inc-data-breach-notice-consumers
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Apr 3, 2026
- Raw hash
- fe7ab6674b482af32dba4b56da9782ca08c86023f0479b3101c770abd3619dd2
Reporting entity
- Name
- Graebel Companies, Inc.norm: graebel companies
Victim entity
- Name
- Graebel Companies, Inc.norm: graebel companies
Incident
- Discovered
- Dec 19, 2024
- Materiality determined
- Nov 10, 2025
- Notification sent
- Nov 13, 2025
- Affected individuals
- 4
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENT
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1078 Valid AccountsT1119 Automated Collection
- Threat actor
- External
- Regulator citations
- Reported this event to federal law enforcementProvided written notice to your Office (the “November Notice”)
Compliance
- Time to disclose
- 16 months(470 days from discovery to filing)
- Compliance flags
- VT AG >45 bday
- Discovery-date grounding
- occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.