MalwareRansomwareData ExfiltratedData EncryptedCustomer Data InvolvedTargetedIDENTITY_BASICIDENTITY_GOVERNMENTMediumContained
The Salvation Army USA
bd_f3d18c4d65a25b4c · schema v1 · pii pii-v1
Full breach record for The Salvation Army USA →The Salvation Army (Eastern Territory) disclosed a ransomware attack occurring on May 24, 2025, affecting 2 New Hampshire residents. The incident involved unauthorized access and exfiltration of PII, including SSNs and driver's license numbers. The organization engaged forensic investigators, notified the FBI, and provided 12 months of credit monitoring. Notification letters were mailed on August 27, 2025.
This filing is one of 3 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (2) · sorted by filing gap
- bd_aff5f1428e993a46Indiana State AGfiled 2025-08-27Verified
- bd_b23381584da8a93cVermont State AGfiled 2025-08-27Candidate
Source provenance
- Source URL
- https://mm.nh.gov/files/uploads/doj/remote-docs/salvation-army-new-york-20250827.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Aug 27, 2025
- Raw hash
- 6e938acc000213fca676e829be342b64ca432d106128e7993b2027106c45475f
Reporting entity
- Name
- The Salvation Army USAnorm: the salvation army usa
- Domain
- salvationarmyusa.org
Victim entity
- Name
- The Salvation Army USAnorm: the salvation army usa
- Domain
- salvationarmyusa.org
Incident
- Discovered
- May 24, 2025
- Materiality determined
- —
- Notification sent
- Aug 27, 2025
- Affected individuals
- 2
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENT
- Attack vector
- Ransomware
- MITRE ATT&CK
- T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 Channel
- Threat actor
- ExternalFinancial
- Regulator citations
- Notified the FBI and is fully cooperating with their investigation
Compliance
- Time to disclose
- 14 weeks(95 days from discovery to filing)
- Compliance flags
- — (clock not assessable for this source)
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.