HackingStolen CredentialsSupply Chain (3P Vendor)Customer Data InvolvedIDENTITY_BASICFINANCIAL_ACCOUNTLowContained
Johnson County Park and Recreation District
bd_a0b2a3ca45dad305 · schema v1 · pii pii-v1
Full breach record for Johnson County Park and Recreation District →Johnson County Park and Recreation District (JCPRD) notified consumers of a data breach involving its third-party provider, Skyway Networks. Unauthorized code was present on the online ticket sales checkout page from March 13, 2025, to September 30, 2025, potentially capturing credit card numbers, expiration dates, and CVVs. No actual access was confirmed, but JCPRD offered credit monitoring and reset passwords.
Vermont clock⏱ VT AG >14 bday6 weeks discovery → filing
⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident
Source provenance
- Source URL
- https://ago.vermont.gov/document/2025-11-11-johnson-county-park-and-recreation-district-data-breach-notice-consumers
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Nov 11, 2025
- Raw hash
- cd7a2eb43182a8d19f99647c84130fb4370e6071a21a220ad5c32bb214ada6f1
Reporting entity
- Name
- Johnson County Park and Recreation Districtnorm: johnson county park and recreation district
Victim entity
- Name
- Johnson County Park and Recreation Districtnorm: johnson county park and recreation district
Incident
- Discovered
- Sep 30, 2025
- Materiality determined
- —
- Notification sent
- Nov 11, 2025
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_BASICFINANCIAL_ACCOUNT
- Attack vector
- Third-Party / Supply Chain
- MITRE ATT&CK
- T1190 Exploit Public-Facing ApplicationT1078 Valid Accounts
- Threat actor
- ExternalFinancial
- Third party
- via Skyway Networks
- Initial access
- exploit_public_facing
Compliance
- Time to disclose
- 6 weeks(42 days from discovery to filing)
- Compliance flags
- VT AG >14 bday
- Discovery-date grounding
- unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.