HackingOtherStolen CredentialsSupply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedPIIIdentity (basic)MediumContained

The Episcopal Church Foundation

bd_e7d214e043ade00a · schema v1 · pii pii-v1

Severity

Medium

Discovered

Feb 17, 2025

Filed

Jul 28, 2025

To disclose

23 weeks

Affected · nationwide

1,47513 in this filing

Linked

2 filings

Confidence

66%

The Episcopal Church Foundation reported a third-party IT vendor breach occurring Feb 7-17, 2025. Unauthorized access led to acquisition of files containing personal information. 1,475 individuals affected, including 13 Maine residents. ECF severed vendor connection, engaged forensic experts, notified law enforcement, and offered 24 months of TransUnion credit monitoring.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Feb 17, 2025 → Filed with AG Jul 28, 2025161d ✗ ME AG >90d23 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 10 days

discovery → filing · 23 weeks / 161 days

Feb 7, 2025

Begins

Feb 17, 2025

Discovered

Jul 28, 2025

Filed

vs. sector median

+15 wks slower

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Indiana State AGbd_94b5f0476cdd0a6a2025-07-28Verified

Name: MORGAN, LEWIS & BOCKIUS LLP
norm: morgan lewis bockius

Name: The Episcopal Church Foundation
norm: episcopal church foundation
Domain: episcopalchurch.org
Industry: Otherllm

Discovered: Feb 17, 2025
Breach occurred: Feb 7, 2025 – Feb 17, 2025
Undetected for: 10 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jul 28, 2025
Affected individuals: 1,475state + nationwide
Data types: PIIIdentity (basic)
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain CompromiseT1078 Valid Accounts
Threat actor: External
Regulator citations: Filed notice with Maine Attorney General
Initial access: supply_chain

During the incident: Severing our connection with the third-party IT vendor
Taking certain systems offline
Launched an investigation with the assistance of external cybersecurity experts
Notified law enforcement
Changes made: Strengthened security controls
Offering complimentary twenty-four (24)-month membership to TransUnion’s triple bureau credit monitoring and fraud assistance
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 23 weeks(161 days from discovery to filing)
Compliance flags: ME AG >90d · 161dME resident >60d · 161d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Feb 17, 2025
→ Filed with AG: Jul 28, 2025
161d 90 days ME AG >90d
Maine
Discovered: Feb 17, 2025
→ Notified: Jul 28, 2025
161d 60 days (analyst band; statutory cap is 30 days) ME resident >60d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Feb 17, 2025 → Filed with AG: Jul 28, 2025	161d	90 days	ME AG >90d
Maine	Discovered: Feb 17, 2025 → Notified: Jul 28, 2025	161d	60 days (analyst band; statutory cap is 30 days)	ME resident >60d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Indiana State AGJul 28 · first

Maine State AGJul 28 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/4877c9d1-ae26-4b56-b342-824cf7318c4b.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 28, 2025
Raw hash: 65fcba605046bfae38f68a926f748b47f10e605798a73f5025ea915432bfb67b

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityMORGAN, LEWIS & BOCKIUS LLP

Victim entityThe Episcopal Church Foundation

Incidentdiscovered Feb 17, 2025

Stated responseSevering our connection with the third-party IT vendor

ComplianceME AG >90d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov