HackingBrute ForceTargetedIDENTITY_BASICCREDENTIALSLowContained
The Shubert Organization, Inc.
bd_edd918dd46765435 · schema v1 · pii pii-v1
Full breach record for The Shubert Organization, Inc. →The Schubert Organization Inc. reported a data breach on January 19, 2026, where an unknown actor performed a brute force attack on its Telecharge ticketing website. The incident compromised names, usernames, and passwords for 48 Vermont residents. Shubert deactivated affected accounts and notified residents on March 20, 2026, providing guidance on identity theft protection.
Vermont clock⏱ VT AG >14 bday9 weeks discovery → filing
⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
This filing is one of 2 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (1) · sorted by filing gap
- bd_153b5f196c04631bCalifornia State AGfiled 2026-03-20Candidate
Source provenance
- Source URL
- https://ago.vermont.gov/document/2026-03-20-schubert-organization-inc-data-breach-notice-consumers
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Mar 20, 2026
- Raw hash
- e26be6093b48fab22db4073c7782024bce04a56c8293b31c124fcc989fada28e
Reporting entity
- Name
- The Shubert Organization, Inc.norm: the shubert organization
Victim entity
- Name
- The Shubert Organization, Inc.norm: the shubert organization
Incident
- Discovered
- Jan 19, 2026
- Materiality determined
- —
- Notification sent
- Mar 20, 2026
- Affected individuals
- 48
- Data types
- IDENTITY_BASICCREDENTIALS
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1110 Brute Force
- Threat actor
- External
- Regulator citations
- Providing written notice of this incident to relevant state regulators
Compliance
- Time to disclose
- 9 weeks(60 days from discovery to filing)
- Compliance flags
- VT AG >14 bday
- Discovery-date grounding
- occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.