HackingGovernmentGovernmentStolen CredentialsTargetedPIIIdentity (basic)LowContained

Lorain County Auditor's Office

bd_9d485efc3c2da1fb · schema v1 · pii pii-v1

Severity

Low

Discovered

May 23, 2025

Filed

Sep 19, 2025

To disclose

17 weeks

Affected

Not disclosed

Linked

6 filings

Confidence

66%

Full breach record for Lorain County Auditor's Office →

Lorain County Auditor's Office notified consumers of a data breach detected on May 23, 2025, where an unauthorized party accessed the internal network. The incident involved personally identifiable information. The Office engaged external cybersecurity professionals for forensic investigation and is offering complimentary identity monitoring services to affected individuals.

J jump to incidentP pin to compareR raw source

Vermont clock✗ VT AG >45 bday17 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

discovery → filing · 17 weeks / 119 days

May 23, 2025

Discovered

Sep 19, 2025

Filed

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Massachusetts State AGbd_5438968e269061a12025-09-19Verified
Maine State AGbd_689096425d594a9a2025-09-19Candidate
Indiana State AGbd_c481abdf0b33025f2025-09-19Verified
Nebraska State AGbd_de421936869683872025-09-19Verified

Show 1 more filing ↓up to 6d gap

New Hampshire State AGbd_d5f6fda3b2a133582025-09-25 · +6dVerified

Name: Lorain County Auditor's Office
norm: lorain county auditor s office

Name: Lorain County Auditor's Office
norm: lorain county auditor s office
Industry: Governmentllm

Discovered: May 23, 2025
Materiality determined: —
Notification sent: Sep 19, 2025
Affected individuals: Not disclosed
Data types: PIIIdentity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Initial access: valid_credentials

During the incident: Commenced a prompt and thorough investigation
Working very closely with external cybersecurity professionals
Conducted an extensive forensic investigation and document review
Secured the services of Privacy Solutions to provide complimentary identity monitoring
Changes made: Continually evaluate and modify practices to enhance the security and privacy of personal information
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 17 weeks(119 days from discovery to filing)
Compliance flags: VT AG >45 bday
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

Massachusetts State AGSep 19 · first

Maine State AGSep 19 · first

Indiana State AGSep 19 · first

Nebraska State AGSep 19 · first

Vermont State AGSep 19 · first · this page

New Hampshire State AG+6d

Pattern: first filing Sep 19 (MA), last Sep 25 (NH) — a 6-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ago.vermont.gov/document/2025-09-19-lorain-county-auditors-office-data-breach-notice-consumers
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 19, 2025
Raw hash: da3c31e4978e22815a1c48034d76638a95034a59a84888b572af20898431a2b1

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityLorain County Auditor's Office

Victim entityLorain County Auditor's Office

Incidentdiscovered May 23, 2025

Stated responseCommenced a prompt and thorough investigation

ComplianceVT AG >45 bday

Extraction provenanceno artifact recorded

Source provenanceago.vermont.gov