HackingPhishingStolen CredentialsData ExfiltratedCustomer Data InvolvedEmployee Data InvolvedDelayed DiscoveryIDENTITY_BASICIDENTITY_GOVERNMENTFINANCIAL_ACCOUNTCREDENTIALSCriticalContained
Gale Associates, Inc.
bd_8fc4854ef0a6b3ed · schema v1 · pii pii-v1
Full breach record for Gale Associates, Inc. →Gale Associates, a financial services firm, disclosed a data breach affecting approximately 100,000 individuals. The incident involved unauthorized access to systems containing PII, government IDs, financial account numbers, and credentials. The breach was discovered in August 2025. Gale Associates engaged Mandiant for forensic investigation and notified law enforcement. Affected individuals were offered credit monitoring and identity theft protection services.
Vermont clock⏱ VT AG >14 bday6 weeks discovery → filing
⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
This filing is one of 3 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (2) · sorted by filing gap
- bd_19173f0972c04e4cMaine State AGfiled 2025-09-12Candidate
- bd_d2f187b64f0cd844New Hampshire State AGfiled 2025-09-12Verified
Source provenance
- Source URL
- https://ago.vermont.gov/document/2025-09-12-gale-associates-data-breach-notice-consumers
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Sep 12, 2025
- Raw hash
- a153a6b41c3f54a65543fb059428dc05d6225e4543d60c01fddc442ab1403bbc
Reporting entity
- Name
- Gale Associates, Inc.norm: gale associates
Victim entity
- Name
- Gale Associates, Inc.norm: gale associates
Incident
- Discovered
- Aug 1, 2025
- Materiality determined
- Sep 12, 2025
- Notification sent
- Sep 12, 2025
- Affected individuals
- 100,000
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENTFINANCIAL_ACCOUNTCREDENTIALS
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1190 Exploit Public-Facing ApplicationT1078 Valid AccountsT1041 Exfiltration Over C2 Channel
- Threat actor
- ExternalFinancial
- Regulator citations
- Notified Vermont Attorney General's OfficeCooperating with Vermont Attorney General's Office investigation
- Initial access
- phishing_link
Compliance
- Time to disclose
- 6 weeks(42 days from discovery to filing)
- Compliance flags
- VT AG >14 bday
- Discovery-date grounding
- occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.