HackingData ExfiltratedIDENTITY_BASICIDENTITY_GOVERNMENTMediumContained
Barr and Barr
bd_88b4177324f68d32 · schema v1 · pii pii-v1
Full breach record for Barr and Barr →Barr & Barr notified consumers of a data breach where unknown actors accessed its network on September 4, 2025, copying files containing names and Social Security numbers. The breach was discovered on November 6, 2025. Barr & Barr notified federal law enforcement and is offering complimentary identity monitoring services through Kroll.
Vermont clock⏱ VT AG >14 bday28 days discovery → filing
⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
This filing is one of 5 about the same incident.View merged incident
A leak claim by akira about this victim predates this filing by 91 days.View originating leak claim
Linked disclosures
Why this link?Ransomware claims (2)
- bd_5cf8932058aa8e7cLeak Siteakirafiled 2025-10-01(64d gap)Verified by operator
- bd_e6b082e130b11fd4Leak Siteakirafiled 2025-09-04(91d gap)Verified by operator
Regulatory filings (2) · sorted by filing gap
- bd_36280e2196be7b82Maine State AGfiled 2025-12-04Candidate
- bd_7322a31d2c653893Indiana State AGfiled 2025-12-04Verified
Source provenance
- Source URL
- https://ago.vermont.gov/document/2025-12-04-barr-barr-data-breach-notice-consumers
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Dec 4, 2025
- Raw hash
- a85999e12a74a2be5b62d39e6866613308f2187f43df3d530ef1289e9ff054ee
Reporting entity
- Name
- Barr and Barrnorm: barr and barr
- Domain
- barrandbarr.com
Victim entity
- Name
- Barr and Barrnorm: barr and barr
- Domain
- barrandbarr.com
Incident
- Discovered
- Nov 6, 2025
- Materiality determined
- —
- Notification sent
- Dec 4, 2025
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENT
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1078 Valid AccountsT1041 Exfiltration Over C2 Channel
- Threat actor
- External
- Regulator citations
- Filed notice with Vermont Attorney General
Compliance
- Time to disclose
- 28 days(28 days from discovery to filing)
- Compliance flags
- VT AG >14 bdayLeak >90d
- Discovery-date grounding
- unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.