HackingVulnerability ExploitData ExfiltratedCustomer Data InvolvedIDENTITY_BASICFINANCIAL_ACCOUNTMediumContained
Denver Area Council, Boy Scouts of America
bd_9998258978b54089 · schema v1 · pii pii-v1
Full breach record for Denver Area Council, Boy Scouts of America →The Boy Scouts of America reported an external system breach (hacking) occurring between February 7, 2020, and May 20, 2020, discovered on October 13, 2020. The incident affected 4,630 individuals, including 1 Maine resident. Acquired data included names and financial account or credit/debit card numbers (with security codes/PINs). The organization provided written notification to affected individuals on November 25, 2020.
Maine clockDiscovered Oct 13, 2020 → Filed with AG Nov 25, 202043d ⏱ ME AG >30d6 weeks discovery → filing
⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.
Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed4,630 affectedView incident
Source provenance
- Source URL
- https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/bfa89255-e116-41de-90cf-9e3f13f55477.shtml
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Nov 25, 2020
- Raw hash
- de9672819d1b71481b39aab34751a099849f8518c3b0e8de547935be86313a63
Reporting entity
- Name
- Denver Area Council, Boy Scouts of Americanorm: denver area council boy scouts of america
Victim entity
- Name
- Denver Area Council, Boy Scouts of Americanorm: denver area council boy scouts of america
Incident
- Discovered
- Oct 13, 2020
- Materiality determined
- —
- Notification sent
- Nov 25, 2020
- Affected individuals
- 4,630
- Data types
- IDENTITY_BASICFINANCIAL_ACCOUNT
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1190 Exploit Public-Facing Application
- Threat actor
- ExternalFinancial
- Regulator citations
- Filed data breach notice with Maine Attorney General
- Initial access
- exploit_public_facing
Compliance
- Time to disclose
- 6 weeks(43 days from discovery to filing)
- Compliance flags
- ME AG >30d · 43d
- Discovery-date grounding
- AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.
- Clock breakdown
Statute Window Elapsed Threshold Status Maine Discovered: Oct 13, 2020→ Filed with AG: Nov 25, 202043d 30 days (soft) ME AG >30d
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.