MisuseOtherPrivilege AbuseEmployee Data InvolvedIdentity (basic)Government IDMediumContained

Sierra Club

bd_dfe987f053485cfe · schema v1 · pii pii-v1

Severity

Medium

Discovered

Feb 3, 2023

Filed

Oct 5, 2023

To disclose

35 weeks

Affected

8state residents only

Linked

6 filings

Confidence

66%

Full breach record for Sierra Club →

Sierra Club notified Montana residents that a former employee forwarded a file containing names and Social Security numbers of certain employees to a personal email account on February 3, 2023. The activity was discovered during a security audit. Sierra Club terminated the employee, launched an investigation, and offered 12 months of credit monitoring through Experian. No evidence of misuse was found.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 35 weeks / 244 days

Feb 3, 2023

Begins

Feb 3, 2023

Discovered

Oct 5, 2023

Filed

vs. sector median

+27 wks slower

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Maine State AGbd_0817cb1dfc1ba95f2023-10-05Candidate
Vermont State AGbd_2424595bc8ca2c332023-10-05Verified
New Hampshire State AGbd_6210b1910769410b2023-10-05Verified
Massachusetts State AGbd_a5fa06c873e923342023-10-05Verified

Show 1 more filing ↓up to 1d gap

Indiana State AGbd_cf1225f15684e8b82023-10-04 · +1dVerified

Name: Sierra Club
norm: sierra club

Name: Sierra Club
norm: sierra club
Industry: Otherllm

Discovered: Feb 3, 2023
Breach occurred: Feb 3, 2023
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Nov 3, 2023
Affected individuals: 8state-resident count only
Data types: Identity (basic)Government ID
Data elements: Social Security number
Attack vector: Insider
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: Internal
Regulator citations: notifying relevant regulatory authorities
Initial access: insider_action

During the incident: Concluded its investigation
Took steps to further mitigate the risk to this information
Notifying relevant regulatory authorities
Offering you access to credit monitoring and identity theft protection services for 12 months through Experian at no cost
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 35 weeks(244 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

Indiana State AGOct 4 · first

Maine State AG+1d

Vermont State AG+1d

New Hampshire State AG+1d

Massachusetts State AG+1d

Montana State AG+1d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-notification-letter-754.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 5, 2023
Raw hash: 67a3c351b837c23c97ff6feda4654053fbff7730c8e724966b369c3117333137

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entitySierra Club

Victim entitySierra Club

Incidentdiscovered Feb 3, 2023

Stated responseConcluded its investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov