HackingProfessional ServicesProfessional ServicesStolen CredentialsCustomer Data InvolvedFinancial accountIdentity (basic)LowContained

American Association of Critical-Care Nurses

bd_db08057b57a2eded · schema v1 · pii pii-v1

Severity

Low

Discovered

Jul 31, 2025

Filed

Sep 2, 2025

To disclose

5 weeks

Affected

Not disclosed

Linked

12 filings

Confidence

64%

Full breach record for American Association of Critical-Care Nurses →

American Association of Critical-Care Nurses (AACN) notified consumers of a data security incident involving its website's payment system. An unauthorized party accessed payment card information (card number, expiry, CVV), names, and contact details for transactions occurring between March 8, 2025, and July 31, 2025. AACN engaged outside security experts, secured the system, and is offering two years of complimentary credit and identity monitoring.

J jump to incidentP pin to compareR raw source

Vermont clock⏱ VT AG >14 bday5 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 145 days

discovery → filing · 5 weeks / 33 days

Mar 8, 2025

Begins

Jul 31, 2025

Discovered

Sep 2, 2025

Filed

vs. sector median

15 wks faster

This filing is one of 12 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (10) · sorted by filing gap

Texas State AGbd_8242bb219dadeba02025-09-04 · +2dVerified
California State AGbd_475370cbda26655d2025-08-29 · +4dCandidate
Washington State AGbd_49932d69751ea9cc2025-08-29 · +4dVerified
Oregon State AGbd_6820d7d37f0ea9fd2025-08-29 · +4dVerified

Show 6 more filings ↓up to 4d gap

Nebraska State AGbd_6f8364c27b37a2862025-08-29 · +4dVerified
Indiana State AGbd_80f7a1e26b0cb5732025-08-29 · +4dVerified
Montana State AGbd_d266e08df47003892025-08-29 · +4dVerified
Massachusetts State AGbd_d4fb7c7a274a91792025-08-29 · +4dVerified
New Hampshire State AGbd_d512ba3bd7ec0b452025-08-29 · +4dVerified
Maine State AGbd_e05bd527f050d9972025-08-29 · +4dVerified

Showing first 10 of 11 linked disclosures.

Name: American Association of Critical-Care Nurses
norm: american association of critical care nurses
Domain: aacn.org

Name: American Association of Critical-Care Nurses
norm: american association of critical care nurses
Domain: aacn.org
Industry: Professional Servicesllm

Discovered: Jul 31, 2025
Breach occurred: Mar 8, 2025 – Jul 31, 2025
Undetected for: 145 daysoccurrence → discovery
Materiality determined: —
Notification sent: Aug 29, 2025
Affected individuals: Not disclosed
Data types: Financial accountIdentity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: ExternalFinancial
Initial access: exploit_public_facing

During the incident: Investigated the issue with the help of our payment processor and outside security experts
Took steps to secure the payment system
Implemented further security enhancements
Offering two years of credit and identity monitoring services at no cost
Changes made: Implemented further security enhancements to help remediate the issue
Continuing to enhance safeguards to help prevent similar issues from occurring in the future
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 weeks(33 days from discovery to filing)
Compliance flags: VT AG >14 bday
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 11 filings · 11 states

View merged incident ↗

California State AGAug 29 · first

Washington State AGAug 29 · first

Oregon State AGAug 29 · first

Nebraska State AGAug 29 · first

Indiana State AGAug 29 · first

Montana State AGAug 29 · first

Massachusetts State AGAug 29 · first

New Hampshire State AGAug 29 · first

Maine State AGAug 29 · first

Vermont State AG+4d · this page

Texas State AG+6d

Pattern: first filing Aug 29 (CA), last Sep 4 (TX) — a 6-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Cascade drawn from the first 10 linked disclosures of 11 — the full spread may be wider.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ago.vermont.gov/document/2025-09-02-american-association-critical-care-nurses-data-breach-notice-consumers
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 2, 2025
Raw hash: 63446c4fc16eb06254247c87291186d1f385bb47f0ab3fe20b762d94bd3a34ff

Linked disclosures

Regulatory filings (10) · sorted by filing gap

Reporting entityAmerican Association of Critical-Care Nurses

Victim entityAmerican Association of Critical-Care Nurses

Incidentdiscovered Jul 31, 2025

Stated responseInvestigated the issue with the help of our payment processor and outside security experts

ComplianceVT AG >14 bday

Extraction provenanceno artifact recorded

Source provenanceago.vermont.gov