AccidentalMisdeliveryEmployee Data InvolvedIDENTITY_BASICIDENTITY_GOVERNMENTMediumResolved
Civil Air Patrol
bd_fa5fc55cce750fce · schema v1 · pii pii-v1
Full breach record for Civil Air Patrol →Civil Air Patrol notified consumers on August 4, 2023, that on June 29, 2023, an employee inadvertently emailed a list of employee names and Social Security numbers to chaplain corps volunteers. The incident involved internal misdelivery. CAP offered 12-24 months of credit monitoring and is enhancing data privacy policies. At least 4 Rhode Island residents were impacted.
Vermont clock⏱ VT AG >14 bday5 weeks discovery → filing
⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
This filing is one of 4 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (3) · sorted by filing gap
- bd_930ee6b0b9034dedMontana State AGfiled 2023-08-04Candidate
- bd_9916c71b3984cfaaNew Hampshire State AGfiled 2023-08-04Verified
- bd_b9de0e9ae2b0558cMaine State AGfiled 2023-08-04Candidate
Source provenance
- Source URL
- https://ago.vermont.gov/document/2023-08-04-civil-air-patrol-data-breach-notice-consumers
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Aug 4, 2023
- Raw hash
- 67e989f3f7aa4fd66f38071dbb3e5f171eae4f0e06df117f8318e50ca8a0db08
Reporting entity
- Name
- Civil Air Patrolnorm: civil air patrol
Victim entity
- Name
- Civil Air Patrolnorm: civil air patrol
Incident
- Discovered
- Jun 29, 2023
- Materiality determined
- —
- Notification sent
- Aug 4, 2023
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENT
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1534 Internal Remote Services
- Threat actor
- Internal
- Initial access
- insider_action
Compliance
- Time to disclose
- 5 weeks(36 days from discovery to filing)
- Compliance flags
- VT AG >14 bday
- Discovery-date grounding
- occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.