MalwareOtherRansomwareData ExfiltratedRansom DemandedIdentity (basic)Government IDFinancial accountPHIHealth (basic)BiometricHighContained

Water For People

bd_fcdf66f98c82eef3 · schema v1 · pii pii-v1

Severity

High

Discovered

Dec 15, 2023

Filed

Sep 5, 2024

To disclose

38 weeks

Affected

2,084state residents only

Linked

8 records

Confidence

70%

Full breach record for Water For People →

Water For People notified Washington AG of a ransomware incident discovered Dec 15, 2023, affecting 2,084 WA residents. Data included names, SSNs, driver's licenses, financial accounts, PHI, and biometrics. Notification sent Sept 5, 2024, with 12 months credit monitoring.

J jump to incidentP pin to compareR raw source

Washington clock✗ WA AG >90d38 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 1 days

discovery → filing · 38 weeks / 265 days

Dec 14, 2023

Begins

Dec 15, 2023

Discovered

Sep 5, 2024

Filed

vs. sector median

+32 wks slower

This filing is one of 8 records about the same incident.View merged incident

A leak claim by medusa about this victim was first seen 238 days before this filing.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Sitemedusabd_b8955f0cd698c83e2023-12-15 · +265dVerified by operator

Regulatory filings (5) · sorted by filing gap

Vermont State AGbd_1f8df32e54c704c82024-09-05Verified
Montana State AGbd_2f77e69a7542f2f82024-09-05Candidate
New Hampshire State AGbd_328e5b2385a6a76d2024-09-05Verified
Indiana State AGbd_8937325be81321412024-09-05Verified

Show 1 more filing ↓up to 1d gap

Massachusetts State AGbd_d16592a54ea711c12024-09-06 · +1dVerified by operator

Press reports (1)

Pressmedusabd_f6127a1f201b04702023-12-15 · +265dCandidate

Name: C & W Law Group, P.C.
norm: c w law
Domain: cwattorneys.law

Name: Water For People
norm: water for people
Domain: waterforpeople.org
Industry: Otherllm

Discovered: Dec 15, 2023
Breach occurred: Dec 14, 2023 – Dec 15, 2023
Undetected for: 1 dayoccurrence → discovery
Materiality determined: —
Notification sent: Sep 5, 2024
Affected individuals: 2,084state-resident count only
Data types: Identity (basic)Government IDFinancial accountPHIHealth (basic)Biometric
Data elements: NameSocial Security numberDriver's licence numberFinancial account numberDate of birthPassport numberHealth insurance IDBiometric data
WA-stated cause: Cyberattack
WA-stated duration: lifecycle 1-99dexposure 1-99d
WA-stated discovery: Found while ongoingContained same day
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1119 Automated Collection
Threat actor: ExternalFinancial

During the incident: Secured its systems
Engaged a third-party forensic firm to investigate the incident
Provided written notification to the potentially impacted Washington residents via First Class Mail
Offered complimentary credit monitoring and identity protection services for 12 months
Changes made: Enhance the security of our network to prevent similar incidents from occurring in the future
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 38 weeks(265 days from discovery to filing)
Compliance flags: WA AG >90dLeak >180d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

Vermont State AGSep 5 · first

Montana State AGSep 5 · first

New Hampshire State AGSep 5 · first

Indiana State AGSep 5 · first

Washington State AGSep 5 · first · this page

Massachusetts State AG+1d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA30470.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 5, 2024
Raw hash: 74524718366bd2682b2dbd0f194a4017b0ea1a587542b8711b0a1e0ef8a42e3d

Linked disclosures

Ransomware claims (1)

Regulatory filings (5) · sorted by filing gap

Press reports (1)

Reporting entityC & W Law Group, P.C.

Victim entityWater For People

Incidentdiscovered Dec 15, 2023

Stated responseSecured its systems

ComplianceWA AG >90d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com