AccidentalOtherMisdeliveryCustomer Data InvolvedIdentity (basic)Government IDMediumContained

Civil Air Patrol

bd_930ee6b0b9034ded · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jun 29, 2023

Filed

Aug 4, 2023

To disclose

5 weeks

Affected

9state residents only

Linked

6 filings

Confidence

65%

Full breach record for Civil Air Patrol →

Civil Air Patrol notified Montana residents of an error on June 29, 2023, where an employee inadvertently emailed a list of names and Social Security numbers to chaplain corps volunteers. The incident was discovered immediately, and the company initiated an investigation, recalled the email, and offered credit monitoring services.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 5 weeks / 36 days

Jun 29, 2023

Begins

Jun 29, 2023

Discovered

Aug 4, 2023

Filed

vs. sector median

3 wks faster

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Massachusetts State AGbd_80f116b887aeda412023-08-04Verified
New Hampshire State AGbd_9916c71b3984cfaa2023-08-04Verified
Indiana State AGbd_ab830a590bb5b1352023-08-04Verified
Maine State AGbd_b9de0e9ae2b0558c2023-08-04Candidate

Show 1 more filing ↓

Vermont State AGbd_fa5fc55cce750fce2023-08-04Verified

Name: Civil Air Patrol
norm: civil air patrol

Name: Civil Air Patrol
norm: civil air patrol
Industry: Otherllm

Discovered: Jun 29, 2023
Breach occurred: Jun 29, 2023
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Aug 4, 2023
Affected individuals: 9state-resident count only
Data types: Identity (basic)Government ID
Data elements: Social Security number
Attack vector: Unknown
MITRE ATT&CK: T1535 Unused/Unsupported Cloud Storage
Threat actor: Internal
Initial access: insider_action

During the incident: CAP employee attempted to recall the message
Instructed all recipients to delete the e-mail message
Initiated an investigation to determine the full scope and impact
Worked diligently to locate address information for the individuals
Providing you with access to 12/24 months of credit monitoring and identity protection services provided by IDX, a Zerofox Company
Changes made: Reviewing and enhancing our existing policies and procedures related to data privacy
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 weeks(36 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

Massachusetts State AGAug 4 · first

New Hampshire State AGAug 4 · first

Indiana State AGAug 4 · first

Maine State AGAug 4 · first

Vermont State AGAug 4 · first

Montana State AGAug 4 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-notification-letter-518.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 4, 2023
Raw hash: 215072d72d9f5aa36ade3457483625db44c9b1ec12686b68bb9a8dbfe7bc826e

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityCivil Air Patrol

Victim entityCivil Air Patrol

Incidentdiscovered Jun 29, 2023

Stated responseCAP employee attempted to recall the message

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov