HackingStolen CredentialsTargetedIDENTITY_BASICLowContained
Visit Charlottesville
bd_cbcb08c4beceeda9 · schema v1 · pii pii-v1
Full breach record for Visit Charlottesville →Charlottesville Settlement Company (CSC) notified consumers of a data security incident where an unknown actor gained unauthorized access to its network on September 2, 2025. CSC discovered unusual activity on September 4, 2025. The incident may have exposed names and other personal information. CSC engaged external cybersecurity experts, secured its email environment, and is offering 12 or 24 months of complimentary credit monitoring and identity theft protection through IDX.
Vermont clock✗ VT AG >45 bday28 weeks discovery → filing
⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
This filing is one of 3 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (2) · sorted by filing gap
- bd_2094a60fb31ec6d4New Hampshire State AGfiled 2026-03-18Verified
- bd_f42fbb8dbbc0de96Indiana State AGfiled 2026-03-18Candidate
Source provenance
- Source URL
- https://ago.vermont.gov/document/2026-03-18-charlottesville-settlement-company-data-breach-notice-consumers
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Mar 18, 2026
- Raw hash
- c01ad007a1ff4db332ebbcbee320465b2c4cdbe58d232d06c892117afed5815b
Reporting entity
- Name
- Visit Charlottesvillenorm: visit charlottesville
- Domain
- visitcharlottesville.org
Victim entity
- Name
- Visit Charlottesvillenorm: visit charlottesville
- Domain
- visitcharlottesville.org
Incident
- Discovered
- Sep 4, 2025
- Materiality determined
- Mar 10, 2026
- Notification sent
- Mar 18, 2026
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_BASIC
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1078 Valid Accounts
- Threat actor
- External
- Initial access
- valid_credentials
Compliance
- Time to disclose
- 28 weeks(195 days from discovery to filing)
- Compliance flags
- VT AG >45 bday
- Discovery-date grounding
- unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.