HackingGovernmentGovernmentStolen CredentialsTargetedBiometricFinancial accountIdentity (basic)Government IDPHIPIIHealth (basic)MediumContained

Housing Authority of the City of Vancouver

bd_e2157cd9554de6d4 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Oct 21, 2025

Filed

Nov 20, 2025

To disclose

4 weeks

Affected

736state residents only

Confidence

70%

Full breach record for Housing Authority of the City of Vancouver →

The Housing Authority of the City of Vancouver reported unauthorized access to an employee's email account on October 21, 2025. The incident involved 736 Washington residents. The authority engaged forensic investigators and provided 12 months of credit monitoring to affected individuals.

J jump to incidentP pin to compareR raw source

Washington clock✓ WA AG ≤30d4 weeks discovery → filing

⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Incident timeline

discovery → filing · 4 weeks / 30 days

Oct 21, 2025

Begins

Oct 21, 2025

Discovered

Nov 20, 2025

Filed

vs. sector median

7 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed736 affectedView incident

Name: Housing Authority of the City of Vancouver
norm: housing authority of the city of vancouver
Industry: Government

Name: Housing Authority of the City of Vancouver
norm: housing authority of the city of vancouver
Industry: Government
Industry: Governmentllm

Discovered: Oct 21, 2025
Breach occurred: Oct 21, 2025 – Oct 22, 2025
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Nov 20, 2025
Affected individuals: 736state-resident count only
Data types: PIIIdentity (basic)
Data elements: NameSocial Security numberDriver's licence numberFinancial account numberDate of birthMilitary ID numberMedical informationBiometric data
WA-stated cause: Unauthorized Access
WA-stated duration: lifecycle 1-99dexposure 1-99d
WA-stated discovery: Found while ongoing
Attack vector: Insider
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: Internal
Regulator citations: Notified Washington Attorney General
Initial access: valid_credentials

During the incident: Immediately took steps to stop unauthorized access
Confirmed on October 22 that unauthorized access was successfully revoked
Engaged with an external forensic firm to investigate the incident and protect against future occurrences
Partnered with Epiq Privacy Solutions to provide free credit monitoring service for 12 months
Changes made: Partnered with Epiq Privacy Solutions to provide free credit monitoring service for 12 months
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 4 weeks(30 days from discovery to filing)
Compliance flags: WA AG ≤30d
Discovery-date grounding: occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA36279.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 20, 2025
Raw hash: 652d71481ae0e78961713ac356a696051534854f57c9188dd4e0408918f95284

Reporting entityHousing Authority of the City of Vancouver

Victim entityHousing Authority of the City of Vancouver

Incidentdiscovered Oct 21, 2025

Stated responseImmediately took steps to stop unauthorized access

ComplianceWA AG ≤30d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com