HackingOtherStolen CredentialsTargetedPIIIdentity (basic)LowContained

Doyon, Limited

bd_e4537929d4e67181 · schema v1 · pii pii-v1

Severity

Low

Discovered

Apr 2, 2024

Filed

Jun 19, 2025

To disclose

15 months

Affected

Not disclosed

Linked

11 filings

Confidence

66%

Full breach record for Doyon, Limited →

Doyon, Limited notified consumers of a security incident occurring on April 1, 2024, where unauthorized actors accessed IT systems. The breach involved personal information (PII). Doyon engaged forensic experts, notified law enforcement, enhanced security controls, and offered 24 months of identity monitoring via Kroll. The filing was submitted to the Vermont Attorney General on June 19, 2025.

J jump to incidentP pin to compareR raw source

Vermont clock✗ VT AG >45 bday15 months discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 1 days

discovery → filing · 15 months / 443 days

Apr 1, 2024

Begins

Apr 2, 2024

Discovered

Jun 19, 2025

Filed

vs. sector median

+55 wks slower

This filing is one of 11 about the same incident.View merged incident

A leak claim by black_basta about this victim predates this filing by 444 days.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (2)

Leak Siteblack_bastabd_809d4dffcaccd96e2024-04-02 · +443dCandidate
Leak Siteblack_bastabd_58c2397f0f6e1a5a2024-04-01 · +444dVerified

Regulatory filings (8) · sorted by filing gap

Montana State AGbd_1d99d73a1c0748762025-06-12 · +7dVerified
Nebraska State AGbd_611b8c6ac959d9752025-06-12 · +7dVerified
Texas State AGbd_681cd3cf515d55552025-06-12 · +7dVerified
Indiana State AGbd_8bc3101c371cfc202025-06-12 · +7dVerified

Show 4 more filings ↓up to 7d gap

Maine State AGbd_a24319d0a1461cbe2025-06-12 · +7dVerified
California State AGbd_a8719b206ae4468a2025-06-12 · +7dVerified
Washington State AGbd_d478f740aa2a2bd52025-06-12 · +7dVerified
New Hampshire State AGbd_fbdd4f9c42edebab2025-06-12 · +7dVerified

Name: Doyon, Limited
norm: doyon
Domain: doyondrilling.com

Name: Doyon, Limited
norm: doyon
Domain: doyondrilling.com
Industry: Otherllm

Discovered: Apr 2, 2024
Breach occurred: Apr 1, 2024
Undetected for: 1 dayoccurrence → discovery
Materiality determined: Jun 19, 2025
Notification sent: Jun 19, 2025
Affected individuals: Not disclosed
Data types: PIIIdentity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: Notified law enforcement
Initial access: valid_credentials

During the incident: Initiated an investigation
Retained an outside incident response company
Notified law enforcement
Conducted a review with the assistance of external experts
Enhanced network security
Implemented additional security measures
Took steps to block the unauthorized actor(s) access to Doyon networks
Issuing notifications to potentially affected individuals
Reviewing and enhancing information security policies and procedures
Implemented new security controls
Secured the services of Kroll to provide identity monitoring
Changes made: Enhanced network security
Implemented additional security measures
Reviewing and enhancing information security policies and procedures
Implemented new security controls
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 15 months(443 days from discovery to filing)
Compliance flags: VT AG >45 bdayLeak >180d
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 9 filings · 9 states

View merged incident ↗

Montana State AGJun 12 · first

Nebraska State AGJun 12 · first

Texas State AGJun 12 · first

Indiana State AGJun 12 · first

Maine State AGJun 12 · first

California State AGJun 12 · first

Washington State AGJun 12 · first

New Hampshire State AGJun 12 · first

Vermont State AG+7d · this page

Pattern: first filing Jun 12 (MT), last Jun 19 (VT) — a 7-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ago.vermont.gov/document/2025-06-19-doyon-limited-data-breach-notice-consumers
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 19, 2025
Raw hash: 202108ab72b5a993447e79bac53852ab73b7880d896c3c9d474f8505912fc850

Linked disclosures

Ransomware claims (2)

Regulatory filings (8) · sorted by filing gap

Reporting entityDoyon, Limited

Victim entityDoyon, Limited

Incidentdiscovered Apr 2, 2024

Stated responseInitiated an investigation

ComplianceVT AG >45 bday

Extraction provenanceno artifact recorded

Source provenanceago.vermont.gov