HackingCustomer Data InvolvedPIIMediumContained
Rochester Philharmonic Orchestra
bd_c1c85951f3e733f2 · schema v1 · pii pii-v1
Full breach record for Rochester Philharmonic Orchestra →Rochester Philharmonic Orchestra (NY) reported an external system breach (hacking) occurring on 10/21/2025, discovered on 11/11/2025. The incident affected 1,726 individuals, including 3 Maine residents. The organization provided 12 months of credit monitoring services to affected parties.
Maine clockDiscovered Nov 11, 2025 → Filed with AG May 28, 2026198d ✗ ME AG >90d28 weeks discovery → filing
⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.
This filing is one of 5 about the same incident.View merged incident
A leak claim by akira about this victim predates this filing by 225 days.View originating leak claim
Linked disclosures
Why this link?Ransomware claims (2)
- bd_a657d39e33120bb9Leak Siteakirafiled 2025-11-25(184d gap)Verified
- bd_3e1555b835a5290aLeak Siteakirafiled 2025-10-15(225d gap)Verified by operator
Regulatory filings (2) · sorted by filing gap
- bd_74744a5301dae892Indiana State AGfiled 2026-05-27(1d gap)Verified by operator
- bd_253bda8c448c14adMassachusetts State AGfiled 2026-05-01(27d gap)Verified by operator
Source provenance
- Source URL
- https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/9da66eab-c25d-4e8a-9f05-47a9ece1b884.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- May 28, 2026
- Raw hash
- 8871a308249996c0da25bbf550ca2e48a2aa4fc708050211c85ec04016bec2f1
Reporting entity
- Name
- Rochester Philharmonic Orchestranorm: rochester philharmonic orchestra
- Domain
- rpo.org
Victim entity
- Name
- Rochester Philharmonic Orchestranorm: rochester philharmonic orchestra
- Domain
- rpo.org
Incident
- Discovered
- Nov 11, 2025
- Materiality determined
- —
- Notification sent
- May 27, 2026
- Affected individuals
- 1,726
- Data types
- PII
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1190 Exploit Public-Facing Application
- Threat actor
- External
- Initial access
- exploit_public_facing
Compliance
- Time to disclose
- 28 weeks(198 days from discovery to filing)
- Compliance flags
- ME AG >90d · 198dME resident >180d · 197dLeak >180d
- Discovery-date grounding
- AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.
- Clock breakdown
Statute Window Elapsed Threshold Status Maine Discovered: Nov 11, 2025→ Filed with AG: May 28, 2026198d 90 days ME AG >90d Maine Discovered: Nov 11, 2025→ Notified: May 27, 2026197d 180 days ME resident >180d
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.