HackingDelayed DiscoveryIDENTITY_BASICIDENTITY_GOVERNMENTPIIMediumContained
Cove USA
bd_ca1c8f7dccf3fd10 · schema v1 · pii pii-v1
Full breach record for Cove USA →Cove Risk Services, LLC notified consumers of a data breach occurring around May 3, 2025, involving unauthorized access to systems containing names, SSNs, DOBs, and addresses. The breach was discovered on November 10, 2025, after an investigation. The company engaged third-party specialists, enhanced network security, and offered 12 months of credit monitoring.
Vermont clock⏱ VT AG >14 bday5 weeks discovery → filing
⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
This filing is one of 4 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (3) · sorted by filing gap
- bd_8c4f3c3ea44b8387Indiana State AGfiled 2025-12-12Candidate
- bd_6f775e212b7c0fe3New Hampshire State AGfiled 2025-12-22(10d gap)Verified
- bd_f8b2a16b164920deNew Hampshire State AGfiled 2026-01-30(49d gap)Verified
Source provenance
- Source URL
- https://ago.vermont.gov/document/2025-12-12-cove-risk-services-data-breach-notice-consumers
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Dec 12, 2025
- Raw hash
- d7c3827de0a5a401ad45004ff8e3a9360d1d1f9c654519c7b8a01a11830f9c43
Reporting entity
- Name
- Cove USAnorm: cove usa
- Domain
- shopcoveusa.com
Victim entity
- Name
- Cove USAnorm: cove usa
- Domain
- shopcoveusa.com
Incident
- Discovered
- Nov 10, 2025
- Materiality determined
- —
- Notification sent
- Dec 12, 2025
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENTPII
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1190 Exploit Public-Facing Application
- Threat actor
- External
- Initial access
- exploit_public_facing
Compliance
- Time to disclose
- 5 weeks(32 days from discovery to filing)
- Compliance flags
- VT AG >14 bday
- Discovery-date grounding
- unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.