HackingPIIIdentity (basic)LowContained

Rafael Viñoly Architects

bd_ca834c5bb4133939 · schema v1 · pii pii-v2

Severity

Low

Discovered

Jun 6, 2025

Filed

Aug 20, 2025

To disclose

—

Affected

Not disclosed

Linked

2 filings

Confidence

66%

Full breach record for Rafael Viñoly Architects →2 incidents on file

Rafael Viñoly Architects notified Nebraska AG of a security incident occurring on or about April 12, 2024. Unauthorized access was discovered on June 6, 2025, involving full names of affected individuals. The firm engaged cybersecurity experts, contained the incident, and is offering IDX identity protection services, including credit monitoring and a $1M insurance policy.

J jump to incidentP pin to compareR raw source

Leak gap clock✗ Leak >180d

Incident timeline

undetected · 420 days

Apr 12, 2024

Begins

Jun 6, 2025

Discovered

Aug 20, 2025

Filed

This filing is one of 2 about the same incident.View merged incident

A leak claim by blacksuit about this victim predates this filing by 475 days.View originating leak claim

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Massachusetts State AGbd_06acc869bc4010a72025-08-22 · +2dCandidate

Name: Rafael Viñoly Architects
norm: rafael vinoly architects
Domain: vinoly.com

Name: Rafael Viñoly Architects
norm: rafael vinoly architects
Domain: vinoly.com

Discovered: Jun 6, 2025
Breach occurred: Apr 12, 2024
Undetected for: 420 daysoccurrence → discovery
Materiality determined: —
Notification sent: Aug 20, 2025
Affected individuals: Not disclosed
Data types: PIIIdentity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Initial access: valid_credentials

During the incident: Contained the incident
Engaged leading cybersecurity experts to identify what personal information, if any, was involved
Changes made: Offering identity theft protection services through IDX
Offering credit and CyberScan monitoring
Offering a $1,000,000 insurance reimbursement policy
Offering fully managed id theft recovery services
Source: Quoted from the filing itself, not independently verified.

Compliance flags: Leak >180d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Nebraska State AGAug 20 · first · this page

Massachusetts State AG+2d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://nebraska.gov/ago/data-breach/documents/70d68803-27a2-470c-860d-5e5b7ae5907d.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 20, 2025
Raw hash: c499c9d66fbc3c7ee423eaa04f9d670666fe5952f5007b84d9010837af10e352

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityRafael Viñoly Architects

Victim entityRafael Viñoly Architects

Incidentdiscovered Jun 6, 2025

Stated responseContained the incident

ComplianceLeak >180d

Extraction provenanceno artifact recorded

Source provenancenebraska.gov