HackingStolen CredentialsTargetedIDENTITY_BASICIDENTITY_GOVERNMENTFINANCIAL_ACCOUNTMediumContained
Retirement Clearinghouse
bd_e44c3b51110a9ee6 · schema v1 · pii pii-v1
Full breach record for Retirement Clearinghouse →Retirement Clearinghouse notified consumers that between March 15-16, 2023, a small number of files containing names, SSNs, and IRA account numbers were at risk of unauthorized access. The company provided complimentary identity monitoring and is evaluating policies to prevent recurrence. The notice was filed with the Vermont AG on May 12, 2023.
Vermont clock⏱ VT AG >14 bday8 weeks discovery → filing
⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
This filing is one of 6 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (5) · sorted by filing gap
- bd_64cbb92c9ed4d3abMaine State AGfiled 2023-05-12Candidate
- bd_9cb3c2bea8f81f85Oregon State AGfiled 2023-05-12Verified
- bd_babae624a6907883Montana State AGfiled 2023-05-12Verified
- bd_e1b9cf14f5537d0dCalifornia State AGfiled 2023-05-12Verified
Show 1 more filing ↓Show fewer ↑up to 4d gap
- bd_88f5da311421de60New Hampshire State AGfiled 2023-05-16(4d gap)Verified
Source provenance
- Source URL
- https://ago.vermont.gov/document/2023-05-12-retirement-clearinghouse-data-breach-notice-consumers
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- May 12, 2023
- Raw hash
- 60b5ab02ec868fe0de2f9e95ffac0b70c8d56d903ebd9ff37bab600e75d157bd
Reporting entity
- Name
- Retirement Clearinghousenorm: retirement clearinghouse
Victim entity
- Name
- Retirement Clearinghousenorm: retirement clearinghouse
Incident
- Discovered
- Mar 15, 2023
- Materiality determined
- May 12, 2023
- Notification sent
- May 12, 2023
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENTFINANCIAL_ACCOUNT
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1078 Valid Accounts
- Threat actor
- External
- Initial access
- valid_credentials
Compliance
- Time to disclose
- 8 weeks(58 days from discovery to filing)
- Compliance flags
- VT AG >14 bday
- Discovery-date grounding
- occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.