HackingStolen CredentialsSupply Chain (3P Vendor)Data ExfiltratedIDENTITY_BASICIDENTITY_GOVERNMENTPIIMediumActive
NextProtocol Capital, LP
bd_d215a2dd9929411e · schema v1 · pii pii-v1
Full breach record for NextProtocol Capital, LP →GFS NextProtocol GP, LLC notified investors in NextProtocol Capital, LP of a data breach involving vendor Retool, administered by MG Stover. Unauthorized parties queried systems on Sept 19, 2023, accessing PII including SSNs and DOBs. Data export assumed. Credit protection offered.
Vermont clock⏱ VT AG >14 bday7 weeks discovery → filing
⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
This filing is one of 3 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (2) · sorted by filing gap
- bd_a05cfff06f59dab4Vermont State AGfiled 2023-11-10Candidate
- bd_d7835cd79d3a03f8Vermont State AGfiled 2023-11-10Candidate
Source provenance
- Source URL
- https://ago.vermont.gov/document/2023-11-10-gfs-nextprotocol-gp-data-breach-notice-consumers
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Nov 10, 2023
- Raw hash
- ddd9e10eeb8b3b3c0c29b9fdcf72d8899308334259a3bc20e9cbcc61b7a070dc
Reporting entity
- Name
- GFS NextProtocol GP, LLCnorm: gfs nextprotocol gp
Victim entity
- Name
- NextProtocol Capital, LPnorm: nextprotocol capital
Incident
- Discovered
- Sep 19, 2023
- Materiality determined
- —
- Notification sent
- Nov 10, 2023
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENTPII
- Attack vector
- Third-Party / Supply Chain
- MITRE ATT&CK
- T1195 Supply Chain CompromiseT1078 Valid Accounts
- Threat actor
- External
- Initial access
- trusted_relationship
Compliance
- Time to disclose
- 7 weeks(52 days from discovery to filing)
- Compliance flags
- VT AG >14 bday
- Discovery-date grounding
- occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.