HackingProfessional ServicesProfessional ServicesStolen CredentialsSupply Chain (3P Vendor)Customer Data InvolvedPIIIdentity (basic)LowContained

The Episcopal Church Foundation

bd_88051ab4543714d6 · schema v1 · pii pii-v2

Severity

Low

Discovered

Feb 17, 2025

Filed

Jul 28, 2025

To disclose

—

Affected

Not disclosed

Linked

7 filings

Confidence

65%

Full breach record for The Episcopal Church Foundation →

Episcopal Church Foundation notified Nebraska AG on July 28, 2025, of a cybersecurity incident involving a third-party IT vendor. The incident was discovered on February 17, 2025, resulting in unauthorized access to ECF systems. Personal information of individuals was accessed. ECF offered 24 months of credit monitoring. Rhode Island residents (approx. 5) were also impacted.

J jump to incidentP pin to compareR raw source

Incident timeline

Feb 17, 2025

Discovered

Jul 28, 2025

Filed

This filing is one of 7 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (6) · sorted by filing gap

Vermont State AGbd_5e0ac4f183a6bec12025-07-28Verified by operator
Nebraska State AGbd_5ed7d2877675481b2025-07-28Verified by operator
Massachusetts State AGbd_947d8507e574048d2025-07-28Verified by operator
Indiana State AGbd_94b5f0476cdd0a6a2025-07-28Verified

Show 2 more filings ↓up to 2d gap

Maine State AGbd_e7d214e043ade00a2025-07-28Candidate
New Hampshire State AGbd_faa9bfc58c8897692025-07-30 · +2dVerified by operator

Name: The Episcopal Church Foundation
norm: the episcopal church

Name: The Episcopal Church Foundation
norm: the episcopal church
Industry: Professional Servicesllm

Discovered: Feb 17, 2025
Materiality determined: —
Notification sent: Jul 28, 2025
Affected individuals: Not disclosed
Data types: PIIIdentity (basic)
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain Compromise
Threat actor: Partner
Regulator citations: notified law enforcement
Initial access: supply_chain

During the incident: Severing our connection with the third-party IT vendor
Taking certain systems offline
Launched with the assistance of external cybersecurity experts
Notified law enforcement
Changes made: Offering you a complimentary twenty-four (24)-month membership to TransUnion’s triple bureau (Transunion, Experian, and Equifax) credit monitoring and fraud assistance
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 7 filings · 6 states

View merged incident ↗

Vermont State AGJul 28 · first

Nebraska State AGJul 28 · first

Massachusetts State AGJul 28 · first

Indiana State AGJul 28 · first

Maine State AGJul 28 · first

Nebraska State AGJul 28 · first · this page

New Hampshire State AG+2d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://nebraska.gov/ago/data-breach/documents/5ba4ca2d-ce9f-4f50-a8ac-8fcdc32c1f8b.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 28, 2025
Raw hash: 819ac4b87bb002631b3419d08324f00da2475ff60ad4d4f1e6d74dd46c3d52c8

Linked disclosures

Regulatory filings (6) · sorted by filing gap

Reporting entityThe Episcopal Church Foundation

Victim entityThe Episcopal Church Foundation

Incidentdiscovered Feb 17, 2025

Stated responseSevering our connection with the third-party IT vendor

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancenebraska.gov