Social EngineeringPhishingStolen CredentialsCustomer Data InvolvedPIIIDENTITY_BASICLowContained
Hermann Financial Services
bd_972bc365c4d0aff7 · schema v1 · pii pii-v1
Full breach record for Hermann Financial Services →Hermann Financial Services, Inc. notified consumers of a data security incident involving unauthorized access to an employee email account between June 13 and June 25, 2025. The breach was discovered on September 15, 2025, after analysis revealed personal information was contained in the accessed emails. The company engaged Kroll to provide complimentary identity monitoring services to affected individuals.
Vermont clock⏱ VT AG >14 bday4 weeks discovery → filing
⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
This filing is one of 3 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (2) · sorted by filing gap
- bd_3eee47109c30e0fbMaine State AGfiled 2025-10-15Candidate
- bd_a930c1b5b1f086d8Delaware State AGfiled 2025-10-15Verified
Source provenance
- Source URL
- https://ago.vermont.gov/document/2025-10-15-hermann-financial-services-data-breach-notice-consumers
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Oct 15, 2025
- Raw hash
- 2de56b487c909754f06f12b956e680f8697db6cd284f6859b3e6fb7187fbbeca
Reporting entity
- Name
- Hermann Financial Servicesnorm: hermann financial
Victim entity
- Name
- Hermann Financial Servicesnorm: hermann financial
Incident
- Discovered
- Sep 15, 2025
- Materiality determined
- —
- Notification sent
- Oct 15, 2025
- Affected individuals
- Not disclosed
- Data types
- PIIIDENTITY_BASIC
- Attack vector
- Phishing
- MITRE ATT&CK
- T1566.002 Spearphishing LinkT1078 Valid AccountsT1114 Email Collection
- Threat actor
- External
- Initial access
- phishing_link
Compliance
- Time to disclose
- 4 weeks(30 days from discovery to filing)
- Compliance flags
- VT AG >14 bday
- Discovery-date grounding
- unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.