MalwareOtherRansomwareData EncryptedSupply Chain (3P Vendor)PIIIdentity (basic)Financial accountLowContained

Research Center for Children, Youth & Families

bd_d3e72e34f4656d0e · schema v1 · pii pii-v1

Severity

Low

Discovered

Aug 2, 2022

Filed

Sep 21, 2022

To disclose

6 days

Affected

4state residents only

Linked

5 filings

Confidence

65%

Full breach record for Research Center for Children, Youth & Families →

Research Center for Children, Youth & Families, Inc. notified Montana residents of a data security incident involving third-party vendor FreeStyle Solutions. Malware was identified on FreeStyle's servers hosting RCCYF's online store. The incident impacted customer data from purchases made between September 18, 2020, and February 3, 2022. RCCYF determined on September 15, 2022, that personal information may have been impacted. FreeStyle removed malware, notified law enforcement, and coordinated with payment card brands.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 683 days

discovery → filing · 7 weeks / 50 days

Sep 18, 2020

Begins

Aug 2, 2022

Discovered

Sep 21, 2022

Filed

vs. sector median

7 wks faster

This filing is one of 5 about the same incident.View merged incident

Part of FreeStyle Solutions supply-chain incident (2022) — a supply-chain cascade affecting multiple organizations.View cascade →

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

New Hampshire State AGbd_407d9f3192e62ab92022-09-21Verified
Indiana State AGbd_6a96fb06ad496d272022-09-21Verified
Massachusetts State AGbd_188a21a054115c3a2022-09-22 · +1dVerified
Maine State AGbd_fa58b4483ae61e1d2022-09-19 · +2dCandidate

Name: Research Center for Children, Youth & Families
norm: research center for children youth families

Name: Research Center for Children, Youth & Families
norm: research center for children youth families
Industry: Otherllm

Discovered: Aug 2, 2022
Breach occurred: Sep 18, 2020 – Feb 3, 2022
Undetected for: 683 daysoccurrence → discovery
Materiality determined: —
Notification sent: Sep 20, 2022
Affected individuals: 4state-resident count only
Data types: PIIIdentity (basic)Financial account
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Notified federal law enforcement authorities
Third party: via FreeStyle Solutions
Initial access: supply_chain

During the incident: FreeStyle removed the malware and blocked further unauthorized activity
FreeStyle notified federal law enforcement authorities
FreeStyle coordinating with payment card brands
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 days(6 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Maine State AGSep 19 · first

New Hampshire State AG+2d

Indiana State AG+2d

Montana State AG+2d · this page

Massachusetts State AG+3d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-Notification-Letter-577.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 21, 2022
Raw hash: 2bccfc3297278b773f72039af746e0dfecffb21b88dc21d2f4968490ddda9375

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityResearch Center for Children, Youth & Families

Victim entityResearch Center for Children, Youth & Families

Incidentdiscovered Aug 2, 2022

Stated responseFreeStyle removed the malware and blocked further unauthorized activity

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov