Social EngineeringPhishingCustomer Data InvolvedPIIIDENTITY_BASICLowContained
Lessing’s Hospitality Group
bd_97bf991d611fe1c9 · schema v1 · pii pii-v1
Full breach record for Lessing’s Hospitality Group →Lessing’s Hospitality Group notified consumers of a data security incident discovered on August 20, 2025, involving unauthorized access to an employee's email account. The incident may have exposed personal information, including names and email addresses. The company engaged a forensic security firm to confirm the security of its email environment and is notifying affected individuals across multiple states, including Vermont and Rhode Island.
Vermont clock⏱ VT AG >14 bday6 weeks discovery → filing
⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident
Source provenance
- Source URL
- https://ago.vermont.gov/document/2025-10-03-lessings-hospitality-group-data-breach-notice-consumers
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Oct 3, 2025
- Raw hash
- 6b21fef286918fa66f0b9837cc1c6c08af9cd6fd942b06b5879d030d7330a09b
Reporting entity
- Name
- Lessing’s Hospitality Groupnorm: lessing s hospitality
Victim entity
- Name
- Lessing’s Hospitality Groupnorm: lessing s hospitality
Incident
- Discovered
- Aug 20, 2025
- Materiality determined
- —
- Notification sent
- Oct 3, 2025
- Affected individuals
- Not disclosed
- Data types
- PIIIDENTITY_BASIC
- Attack vector
- Phishing
- MITRE ATT&CK
- T1566.002 Spearphishing LinkT1078 Valid Accounts
- Threat actor
- External
- Initial access
- phishing_link
Compliance
- Time to disclose
- 6 weeks(44 days from discovery to filing)
- Compliance flags
- VT AG >14 bday
- Discovery-date grounding
- unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.