HackingStolen CredentialsTargetedIDENTITY_BASICCREDENTIALSLowContained
Goodwill Industries of Greater New York and Northern NJ, Inc.
bd_cc712db3d1740f17 · schema v1 · pii pii-v1
Full breach record for Goodwill Industries of Greater New York and Northern NJ, Inc. →Goodwill Industries of Greater New York and Northern NJ, Inc. notified consumers of an unauthorized access to an employee email account between Oct 12-29, 2022. The breach exposed names and an extra identifier. Goodwill secured the account, reset passwords, reported to law enforcement, and offered 24 months of credit monitoring. Approximately 3 Rhode Island residents were impacted.
Vermont clock✗ VT AG >45 bday30 weeks discovery → filing
⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
This filing is one of 2 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (1) · sorted by filing gap
- bd_b4518d118b65809dNew Hampshire State AGfiled 2023-05-31(7d gap)Verified
Source provenance
- Source URL
- https://ago.vermont.gov/document/2023-05-24-goodwill-industries-greater-new-york-and-northern-nj-data-breach-notice-consumers
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- May 24, 2023
- Raw hash
- a37ac926588ab8851535521f9010b1c8462a027d50f0af10d08ae26280271622
Reporting entity
- Name
- Goodwill Industries of Greater New York and Northern NJ, Inc.norm: goodwill industries of greater new york and northern nj
- Domain
- goodwillnynj.org
Victim entity
- Name
- Goodwill Industries of Greater New York and Northern NJ, Inc.norm: goodwill industries of greater new york and northern nj
- Domain
- goodwillnynj.org
Incident
- Discovered
- Oct 28, 2022
- Materiality determined
- —
- Notification sent
- May 24, 2023
- Affected individuals
- 3
- Data types
- IDENTITY_BASICCREDENTIALS
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1078 Valid Accounts
- Threat actor
- External
- Regulator citations
- reported the event to federal law enforcementnotifying relevant regulatory authorities
- Initial access
- valid_credentials
Compliance
- Time to disclose
- 30 weeks(208 days from discovery to filing)
- Compliance flags
- VT AG >45 bday
- Discovery-date grounding
- unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.