HackingVulnerability ExploitSupply Chain (3P Vendor)Data ExfiltratedIDENTITY_BASICIDENTITY_GOVERNMENTMediumContained
America Works of New York Inc.
bd_a37911da86ec03f3 · schema v1 · pii pii-v1
Full breach record for America Works of New York Inc. →America Works of New York Inc. notified employees of a data breach involving their payroll provider, Paycor. Paycor's MOVEit transfer software was exploited in May 2023, leading to the unauthorized access of employee data including names, dates of birth, and Social Security numbers. America Works engaged Kroll to provide 12 months of free identity monitoring services to affected individuals.
Vermont clock⏱ VT AG >14 bday27 days discovery → filing
⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident
Source provenance
- Source URL
- https://ago.vermont.gov/document/2023-12-27-america-works-new-york-progress-software-moveit-data-breach-notice-consumers
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Dec 27, 2023
- Raw hash
- 4b2d2d3df67bcda05376f7b212ebd544b7b07c1da0fd3cb25c1093bdd6244d13
Reporting entity
- Name
- America Works of New York Inc.norm: america works of new york
Victim entity
- Name
- America Works of New York Inc.norm: america works of new york
Incident
- Discovered
- Nov 30, 2023
- Materiality determined
- —
- Notification sent
- Dec 27, 2023
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENT
- Attack vector
- Third-Party / Supply Chain
- MITRE ATT&CK
- T1195 Supply Chain CompromiseT1190 Exploit Public-Facing Application
- Threat actor
- ExternalFinancial
- Regulator citations
- Filed notice with Vermont Attorney General
- Third party
- via Paycor
- Initial access
- supply_chain
Compliance
- Time to disclose
- 27 days(27 days from discovery to filing)
- Compliance flags
- VT AG >14 bday
- Discovery-date grounding
- unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.