HackingTelecom & MediaInformationVulnerability ExploitZero-DayData ExfiltratedCustomer Data InvolvedEmployee Data InvolvedSupply Chain (3P Vendor)Identity (basic)Government IDFinancial accountHealth (basic)EmploymentMediumContained

The Washington Post

bd_7696587630ae34ed · schema v1 · pii pii-v1

Severity

Medium

Discovered

Oct 1, 2025

Filed

Jul 13, 2026

To disclose

41 weeks

Affected

102state residents only

Linked

15 filings

Confidence

66%

Full breach record for The Washington Post →2 incidents on file

The Washington Post experienced a data security incident resulting from a previously unknown vulnerability in Oracle E-Business Suite software. Unauthorized access occurred between July 10, 2025, and August 22, 2025. The Post discovered the issue in October 2025. This supplemental notice updates a prior notification, identifying an additional 102 New Hampshire residents affected. Compromised data included names, bank account numbers, routing numbers, health insurance information, employee IDs, and Social Security numbers. The Post engaged forensic experts, secured systems, applied patches, and offered identity protection services.

J jump to incidentP pin to compareR raw source

Leak gap clock✗ Leak >180d41 weeks discovery → filing

Incident timeline

undetected · 83 days

discovery → filing · 41 weeks / 285 days

Jul 10, 2025

Begins

Oct 1, 2025

Discovered

Jul 13, 2026

Filed

This filing is one of 15 about the same incident.View merged incident

Part of ORACLE CORPORATION supply-chain incident (2025) — a supply-chain cascade affecting multiple organizations.View cascade →

A leak claim by cl0p about this victim predates this filing by 247 days.View originating leak claim

Linked disclosures

Why this link?

Regulatory filings (10) · sorted by filing gap

Washington State AGbd_63991b5360c381222026-07-13Verified by operator
California State AGbd_78926bf02d97b8f82026-07-13Verified by operator
Vermont State AGbd_c1d11a5eb36e7ede2026-07-13Verified by operator
Oregon State AGbd_0d97643c7c02e0a62026-07-14 · +1dVerified by operator

Show 6 more filings ↓up to 243d gap

Texas State AGbd_8e858a0885ff65162026-07-14 · +1dVerified by operator
Indiana State AGbd_209d44025d2c2a3d2025-11-12 · +243dVerified
Montana State AGbd_2d05f81698405b0c2025-11-12 · +243dCandidate
Nebraska State AGbd_6e10abe650a92d392025-11-12 · +243dVerified by operator
Massachusetts State AGbd_ae6db829f44ccef92025-11-12 · +243dVerified by operator
New Hampshire State AGbd_b0c26abd0a0c427f2025-11-12 · +243dVerified

Showing first 10 of 14 linked disclosures.

Name: The Washington Post
norm: the washington post
Domain: zwillgen.com

Name: The Washington Post
norm: the washington post
Domain: washingtonpost.com
Industry: Telecom & Mediallm

Discovered: Oct 1, 2025
Breach occurred: Jul 10, 2025 – Aug 22, 2025
Undetected for: 83 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jul 10, 2026
Affected individuals: 102state-resident count only
Data types: Identity (basic)Government IDFinancial accountHealth (basic)Employment
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: External
Regulator citations: Notified New Hampshire Attorney General
Initial access: exploit_public_facing

During the incident: Launched a thorough investigation of our Oracle application environment with the assistance of forensic experts
Promptly secured its systems and Oracle application environment
Promptly applying patches as soon as Oracle made them available
Provided individuals with information about steps they can take to protect their personal information
Offered individuals whose Social Security numbers or tax ID numbers were affected the chance to enroll in complimentary identity protection services through IDX
Changes made: Applied patches as soon as Oracle made them available
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 41 weeks(285 days from discovery to filing)
Compliance flags: Leak >180d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 11 filings · 10 states

View merged incident ↗

Indiana State AGNov 12 · first

Montana State AGNov 12 · first

Nebraska State AGNov 12 · first

Massachusetts State AGNov 12 · first

New Hampshire State AGNov 12 · first

Washington State AG+243d

California State AG+243d

Vermont State AG+243d

New Hampshire State AG+243d · this page

Oregon State AG+244d

Texas State AG+244d

Pattern: first filing Nov 12 (IN), last Jul 14 (TX) — a 244-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Cascade drawn from the first 10 linked disclosures of 14 — the full spread may be wider.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/washington-post-20260713.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 13, 2026
Raw hash: ddf2ea6ddebc4ee065600bb2b6c07b12df622312ee27f6293d90eeb7ed001c9e

Linked disclosures

Regulatory filings (10) · sorted by filing gap

Reporting entityThe Washington Post

Victim entityThe Washington Post

Incidentdiscovered Oct 1, 2025

Stated responseLaunched a thorough investigation of our Oracle application environment with the assistance of forensic experts

ComplianceLeak >180d

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov