Social EngineeringPhishingDelayed DiscoveryIDENTITY_BASICLowContained
FlexCare, LLC
bd_f478e208364745e5 · schema v1 · pii pii-v1
Full breach record for FlexCare, LLC →FlexCare, LLC notified consumers of a cybersecurity incident discovered on October 9, 2024, involving unauthorized access to an employee's email account. The breach exposed names and other personal information. FlexCare secured the account, investigated the scope, implemented additional security measures, and offered 24 months of credit monitoring via IDX.
Vermont clock✗ VT AG >45 bday21 weeks discovery → filing
⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
This filing is one of 5 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (4) · sorted by filing gap
- bd_16052ffaaad62029New Hampshire State AGfiled 2025-03-05Verified
- bd_50d0344a5a950db5Maine State AGfiled 2025-03-05Candidate
- bd_708228ea66f830f4Indiana State AGfiled 2025-03-05Verified
- bd_d5a1387edf3c35a9Maryland State AGfiled 2025-03-05Verified
Source provenance
- Source URL
- https://ago.vermont.gov/document/2025-03-05-flexcare-data-breach-notice-consumers
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Mar 5, 2025
- Raw hash
- c3bfd8e0405c9f5373c5552f72a43de615aca741152c82f27d401ec5e7594af3
Reporting entity
- Name
- FlexCare, LLCnorm: flexcare
- Domain
- flexcarestaff.com
Victim entity
- Name
- FlexCare, LLCnorm: flexcare
- Domain
- flexcarestaff.com
Incident
- Discovered
- Oct 9, 2024
- Materiality determined
- Mar 5, 2025
- Notification sent
- Mar 5, 2025
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_BASIC
- Attack vector
- Phishing
- MITRE ATT&CK
- T1566.002 Spearphishing Link
- Threat actor
- External
- Initial access
- phishing_link
Compliance
- Time to disclose
- 21 weeks(147 days from discovery to filing)
- Compliance flags
- VT AG >45 bday
- Discovery-date grounding
- occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.