HackingStolen CredentialsSupply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedIDENTITY_BASICIDENTITY_GOVERNMENTMediumContained
OneDigital Investment Advisors LLC
bd_a8e53b1611378d44 · schema v1 · pii pii-v1
Full breach record for OneDigital Investment Advisors LLC →OneDigital Investment Advisors LLC notified Vermont AG that a third-party CRM provider (Salesforce/Drift) was compromised between Aug 12-18, 2025. Data accessed included names, SSNs, and ITINs. 35 Vermont residents notified on Apr 8, 2026. Credit monitoring offered.
Vermont clock✗ VT AG >45 bday33 weeks discovery → filing
⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
This filing is one of 8 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (7) · sorted by filing gap
- bd_16dcd2a6a721552eWashington State AGfiled 2026-04-08Candidate
- bd_17257010d9a4d51aMaine State AGfiled 2026-04-08Verified
- bd_5a1b88518f9bfe89California State AGfiled 2026-04-08Verified
- bd_616a7eca5bff3650New Hampshire State AGfiled 2026-04-08Verified
Show 3 more filings ↓Show fewer ↑up to 12d gap
- bd_89c363698f4bb715Indiana State AGfiled 2026-04-08Verified
- bd_ed2c8dae469e2d8bTexas State AGfiled 2026-04-10(2d gap)Verified by operator
- bd_2634d621d74802adOregon State AGfiled 2026-04-20(12d gap)Candidate
Source provenance
- Source URL
- https://ago.vermont.gov/document/2026-04-08-onedigital-investment-advisors-llc-data-breach-notice-consumers
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Apr 8, 2026
- Raw hash
- f52a8bfbf27359f63e086847cd26dfcee657bec223d51a921eaafc9c673486ca
Reporting entity
- Name
- OneDigital Investment Advisors LLCnorm: onedigital investment advisors
- Domain
- onedigital.com
Victim entity
- Name
- OneDigital Investment Advisors LLCnorm: onedigital investment advisors
- Domain
- onedigital.com
Incident
- Discovered
- Aug 22, 2025
- Materiality determined
- Apr 8, 2026
- Notification sent
- Apr 8, 2026
- Affected individuals
- 35
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENT
- Attack vector
- Third-Party / Supply Chain
- MITRE ATT&CK
- T1195 Supply Chain CompromiseT1041 Exfiltration Over C2 Channel
- Threat actor
- ExternalFinancial
- Initial access
- supply_chain
Compliance
- Time to disclose
- 33 weeks(229 days from discovery to filing)
- Compliance flags
- VT AG >45 bday
- Discovery-date grounding
- unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.